attack.privilege-escalation | Detection.FYI

New AWS Lambda Function URL Configuration Created

Dec 19, 2024 · attack.initial-access attack.privilege-escalation ·
Share on:

Detects when a user creates a Lambda function URL configuration, which could be used to expose the function to the internet and potentially allow unauthorized access to the function's IAM role for AWS API calls. This could give an adversary access to the privileges associated with the Lambda service role that is attached to that function.

Read More
AWS SAML Provider Deletion Activity

Dec 19, 2024 · attack.t1078.004 attack.privilege-escalation attack.t1531 ·
Share on:

Detects the deletion of an AWS SAML provider, potentially indicating malicious intent to disrupt administrative or security team access. An attacker can remove the SAML provider for the information security team or a team of system administrators, to make it difficult for them to work and investigate at the time of the attack and after it.

Read More
Register new Logon Process by Rubeus

Dec 19, 2024 · attack.lateral-movement attack.privilege-escalation attack.credential-access attack.t1558.003 ·
Share on:

Detects potential use of Rubeus via registered new trusted logon process

Read More
AWS Key Pair Import Activity

Dec 19, 2024 · attack.initial-access attack.t1078 attack.persistence attack.privilege-escalation ·
Share on:

Detects the import of SSH key pairs into AWS EC2, which may indicate an attacker attempting to gain unauthorized access to instances. This activity could lead to initial access, persistence, or privilege escalation, potentially compromising sensitive data and operations.

Read More
Always Install Elevated Windows Installer

Dec 1, 2024 · attack.privilege-escalation attack.t1548.002 ·
Share on:

Detects Windows Installer service (msiexec.exe) trying to install MSI packages with SYSTEM privilege

Read More
CMSTP UAC Bypass via COM Object Access

Dec 1, 2024 · attack.execution attack.defense-evasion attack.privilege-escalation attack.t1548.002 attack.t1218.003 attack.g0069 car.2019-04-001 ·
Share on:

Detects UAC Bypass Attempt Using Microsoft Connection Manager Profile Installer Autoelevate-capable COM Objects (e.g. UACMe ID of 41, 43, 58 or 65)

Read More
Exploiting CVE-2019-1388

Dec 1, 2024 · attack.privilege-escalation attack.t1068 cve.2019-1388 detection.emerging-threats ·
Share on:

Detects an exploitation attempt in which the UAC consent dialogue is used to invoke an Internet Explorer process running as LOCAL_SYSTEM

Read More
Possible Privilege Escalation via Weak Service Permissions

Dec 1, 2024 · attack.persistence attack.defense-evasion attack.privilege-escalation attack.t1574.011 ·
Share on:

Detection of sc.exe utility spawning by user with Medium integrity level to change service ImagePath or FailureCommand

Read More
Potential CVE-2021-41379 Exploitation Attempt

Dec 1, 2024 · attack.privilege-escalation attack.t1068 cve.2021-41379 detection.emerging-threats ·
Share on:

Detects potential exploitation attempts of CVE-2021-41379 (InstallerFileTakeOver), a local privilege escalation (LPE) vulnerability where the attacker spawns a "cmd.exe" process as a child of Microsoft Edge elevation service "elevation_service" with "LOCAL_SYSTEM" rights

Read More
Potential Privilege Escalation via Service Permissions Weakness

Dec 1, 2024 · attack.privilege-escalation attack.t1574.011 ·
Share on:

Detect modification of services configuration (ImagePath, FailureCommand and ServiceDLL) in registry by processes with Medium integrity level

Read More
Potential UAC Bypass Via Sdclt.EXE

Dec 1, 2024 · attack.privilege-escalation attack.defense-evasion attack.t1548.002 ·
Share on:

A General detection for sdclt being spawned as an elevated process. This could be an indicator of sdclt being used for bypass UAC techniques.

Read More
Suspicious Child Process Created as System

Dec 1, 2024 · attack.privilege-escalation attack.t1134.002 ·
Share on:

Detection of child processes spawned with SYSTEM privileges by parents with LOCAL SERVICE or NETWORK SERVICE accounts

Read More
Suspicious RazerInstaller Explorer Subprocess

Dec 1, 2024 · attack.privilege-escalation attack.t1553 detection.emerging-threats ·
Share on:

Detects a explorer.exe sub process of the RazerInstaller software which can be invoked from the installer to select a different installation folder but can also be exploited to escalate privileges to LOCAL SYSTEM

Read More
Suspicious SYSTEM User Process Creation

Dec 1, 2024 · attack.credential-access attack.defense-evasion attack.privilege-escalation attack.t1134 attack.t1003 attack.t1027 ·
Share on:

Detects a suspicious process creation as SYSTEM user (suspicious program or command line parameter)

Read More
UAC Bypass Abusing Winsat Path Parsing - Process

Dec 1, 2024 · attack.defense-evasion attack.privilege-escalation attack.t1548.002 ·
Share on:

Detects the pattern of UAC Bypass using a path parsing issue in winsat.exe (UACMe 52)

Read More
UAC Bypass Tools Using ComputerDefaults

Dec 1, 2024 · attack.defense-evasion attack.privilege-escalation attack.t1548.002 ·
Share on:

Detects tools such as UACMe used to bypass UAC with computerdefaults.exe (UACMe 59)

Read More
UAC Bypass Using ChangePK and SLUI

Dec 1, 2024 · attack.defense-evasion attack.privilege-escalation attack.t1548.002 ·
Share on:

Detects an UAC bypass that uses changepk.exe and slui.exe (UACMe 61)

Read More
UAC Bypass Using Consent and Comctl32 - Process

Dec 1, 2024 · attack.defense-evasion attack.privilege-escalation attack.t1548.002 ·
Share on:

Detects the pattern of UAC Bypass using consent.exe and comctl32.dll (UACMe 22)

Read More
UAC Bypass Using Disk Cleanup

Dec 1, 2024 · attack.defense-evasion attack.privilege-escalation attack.t1548.002 ·
Share on:

Detects the pattern of UAC Bypass using scheduled tasks and variable expansion of cleanmgr.exe (UACMe 34)

Read More
UAC Bypass Using DismHost

Dec 1, 2024 · attack.defense-evasion attack.privilege-escalation attack.t1548.002 ·
Share on:

Detects the pattern of UAC Bypass using DismHost DLL hijacking (UACMe 63)

Read More
UAC Bypass Using IDiagnostic Profile

Dec 1, 2024 · attack.execution attack.defense-evasion attack.privilege-escalation attack.t1548.002 ·
Share on:

Detects the "IDiagnosticProfileUAC" UAC bypass technique

Read More
UAC Bypass Using IEInstal - Process

Dec 1, 2024 · attack.defense-evasion attack.privilege-escalation attack.t1548.002 ·
Share on:

Detects the pattern of UAC Bypass using IEInstal.exe (UACMe 64)

Read More
UAC Bypass Using MSConfig Token Modification - Process

Dec 1, 2024 · attack.defense-evasion attack.privilege-escalation attack.t1548.002 ·
Share on:

Detects the pattern of UAC Bypass using a msconfig GUI hack (UACMe 55)

Read More
UAC Bypass Using NTFS Reparse Point - Process

Dec 1, 2024 · attack.defense-evasion attack.privilege-escalation attack.t1548.002 ·
Share on:

Detects the pattern of UAC Bypass using NTFS reparse point and wusa.exe DLL hijacking (UACMe 36)

Read More
UAC Bypass Using PkgMgr and DISM

Dec 1, 2024 · attack.defense-evasion attack.privilege-escalation attack.t1548.002 ·
Share on:

Detects the pattern of UAC Bypass using pkgmgr.exe and dism.exe (UACMe 23)

Read More
UAC Bypass Using Windows Media Player - Process

Dec 1, 2024 · attack.defense-evasion attack.privilege-escalation attack.t1548.002 ·
Share on:

Detects the pattern of UAC Bypass using Windows Media Player osksupport.dll (UACMe 32)

Read More
UAC Bypass WSReset

Dec 1, 2024 · attack.defense-evasion attack.privilege-escalation attack.t1548.002 ·
Share on:

Detects the pattern of UAC Bypass via WSReset usable by default sysmon-config

Read More
GCP Access Policy Deleted

Dec 1, 2024 · attack.persistence attack.privilege-escalation attack.t1098 ·
Share on:

Detects when an access policy that is applied to a GCP cloud resource is deleted. An adversary would be able to remove access policies to gain access to a GCP cloud resource.

Read More
Google Workspace Application Access Level Modified

Dec 1, 2024 · attack.persistence attack.privilege-escalation attack.t1098.003 ·
Share on:

Detects when an access level is changed for a Google workspace application. An access level is part of BeyondCorp Enterprise which is Google Workspace's way of enforcing Zero Trust model. An adversary would be able to remove access levels to gain easier access to Google workspace resources.

Read More
Suspicious Processes Spawned by Java.EXE

Dec 1, 2024 · attack.initial-access attack.persistence attack.privilege-escalation ·
Share on:

Detects suspicious processes spawned from a Java host process which could indicate a sign of exploitation (e.g. log4j)

Read More
HackTool - CoercedPotato Execution

Nov 25, 2024 · attack.defense-evasion attack.privilege-escalation attack.t1055 ·
Share on:

Detects the use of CoercedPotato, a tool for privilege escalation

Read More
HackTool - Impersonate Execution

Nov 25, 2024 · attack.privilege-escalation attack.defense-evasion attack.t1134.001 attack.t1134.003 ·
Share on:

Detects execution of the Impersonate tool. Which can be used to manipulate tokens on a Windows computers remotely (PsExec/WmiExec) or interactively

Read More
HackTool - LocalPotato Execution

Nov 25, 2024 · attack.defense-evasion attack.privilege-escalation cve.2023-21746 ·
Share on:

Detects the execution of the LocalPotato POC based on basic PE metadata information and default CLI examples

Read More
HackTool - SysmonEOP Execution

Nov 25, 2024 · cve.2022-41120 attack.t1068 attack.privilege-escalation ·
Share on:

Detects the execution of the PoC that can be used to exploit Sysmon CVE-2022-41120

Read More
HackTool - UACMe Akagi Execution

Nov 25, 2024 · attack.defense-evasion attack.privilege-escalation attack.t1548.002 ·
Share on:

Detects the execution of UACMe, a tool used for UAC bypasses, via default PE metadata

Read More
PUA - Process Hacker Driver Load

Nov 25, 2024 · attack.privilege-escalation cve.2021-21551 attack.t1543 ·
Share on:

Detects driver load of the Process Hacker tool

Read More
PUA - Process Hacker Execution

Nov 25, 2024 · attack.defense-evasion attack.discovery attack.persistence attack.privilege-escalation attack.t1622 attack.t1564 attack.t1543 ·
Share on:

Detects the execution of Process Hacker based on binary metadata information (Image, Hash, Imphash, etc). Process Hacker is a tool to view and manipulate processes, kernel options and other low level options. Threat actors abused older vulnerable versions to manipulate system processes.

Read More
PUA - System Informer Driver Load

Nov 25, 2024 · attack.privilege-escalation attack.t1543 ·
Share on:

Detects driver load of the System Informer tool

Read More
PUA - System Informer Execution

Nov 25, 2024 · attack.persistence attack.privilege-escalation attack.discovery attack.defense-evasion attack.t1082 attack.t1564 attack.t1543 ·
Share on:

Detects the execution of System Informer, a task manager tool to view and manipulate processes, kernel options and other low level operations

Read More
Vulnerable HackSys Extreme Vulnerable Driver Load

Nov 25, 2024 · attack.privilege-escalation attack.t1543.003 ·
Share on:

Detects the load of HackSys Extreme Vulnerable Driver which is an intentionally vulnerable Windows driver developed for security enthusiasts to learn and polish their exploitation skills at Kernel level and often abused by threat actors

Read More
Vulnerable WinRing0 Driver Load

Nov 25, 2024 · attack.privilege-escalation attack.t1543.003 ·
Share on:

Detects the load of a signed WinRing0 driver often used by threat actors, crypto miners (XMRIG) or malware for privilege escalation

Read More
App Assigned To Azure RBAC/Microsoft Entra Role

Nov 20, 2024 · attack.persistence attack.privilege-escalation attack.t1098.003 ·
Share on:

Detects when an app is assigned Azure AD roles, such as global administrator, or Azure RBAC roles, such as subscription owner.

Read More
HackTool - EfsPotato Named Pipe Creation

Nov 1, 2024 · attack.defense-evasion attack.privilege-escalation attack.t1055 ·
Share on:

Detects the pattern of a pipe name as used by the hack tool EfsPotato

Read More
HackTool - NoFilter Execution

Nov 1, 2024 · attack.privilege-escalation attack.t1134 attack.t1134.001 ·
Share on:

Detects execution of NoFilter, a tool for abusing the Windows Filtering Platform for privilege escalation via hardcoded policy name indicators

Read More
Elevated System Shell Spawned From Uncommon Parent Location

Oct 1, 2024 · attack.privilege-escalation attack.defense-evasion attack.execution attack.t1059 ·
Share on:

Detects when a shell program such as the Windows command prompt or PowerShell is launched with system privileges from a uncommon parent location.

Read More
HackTool - WinPwn Execution

Oct 1, 2024 · attack.credential-access attack.defense-evasion attack.discovery attack.execution attack.privilege-escalation attack.t1046 attack.t1082 attack.t1106 attack.t1518 attack.t1548.002 attack.t1552.001 attack.t1555 attack.t1555.003 ·
Share on:

Detects commandline keywords indicative of potential usge of the tool WinPwn. A tool for Windows and Active Directory reconnaissance and exploitation.

Read More
HackTool - WinPwn Execution - ScriptBlock

Oct 1, 2024 · attack.credential-access attack.defense-evasion attack.discovery attack.execution attack.privilege-escalation attack.t1046 attack.t1082 attack.t1106 attack.t1518 attack.t1548.002 attack.t1552.001 attack.t1555 attack.t1555.003 ·
Share on:

Detects scriptblock text keywords indicative of potential usge of the tool WinPwn. A tool for Windows and Active Directory reconnaissance and exploitation.

Read More
Malicious Driver Load

Oct 1, 2024 · attack.privilege-escalation attack.t1543.003 attack.t1068 ·
Share on:

Detects loading of known malicious drivers via their hash.

Read More
Malicious Driver Load By Name

Oct 1, 2024 · attack.privilege-escalation attack.t1543.003 attack.t1068 ·
Share on:

Detects loading of known malicious drivers via the file name of the drivers.

Read More
Potential Process Hollowing Activity

Oct 1, 2024 · attack.defense-evasion attack.privilege-escalation attack.t1055.012 ·
Share on:

Detects when a memory process image does not match the disk image, indicative of process hollowing.

Read More
Vulnerable Driver Load

Oct 1, 2024 · attack.privilege-escalation attack.t1543.003 attack.t1068 ·
Share on:

Detects loading of known vulnerable drivers via their hash.

Read More
Vulnerable Driver Load By Name

Oct 1, 2024 · attack.privilege-escalation attack.t1543.003 attack.t1068 ·
Share on:

Detects the load of known vulnerable drivers via the file name of the drivers.

Read More
Whoami.EXE Execution From Privileged Process

Oct 1, 2024 · attack.privilege-escalation attack.discovery attack.t1033 ·
Share on:

Detects the execution of "whoami.exe" by privileged accounts that are often abused by threat actors

Read More
PwnKit Local Privilege Escalation

Sep 13, 2024 · attack.privilege-escalation attack.t1548.001 ·
Share on:

Detects potential PwnKit exploitation CVE-2021-4034 in auth logs

Read More
CVE-2021-1675 Print Spooler Exploitation Filename Pattern

Sep 13, 2024 · attack.execution attack.privilege-escalation attack.resource-development attack.t1587 cve.2021-1675 detection.emerging-threats ·
Share on:

Detects the default filename used in PoC code against print spooler vulnerability CVE-2021-1675

Read More
InstallerFileTakeOver LPE CVE-2021-41379 File Create Event

Sep 13, 2024 · attack.privilege-escalation attack.t1068 detection.emerging-threats ·
Share on:

Detects signs of the exploitation of LPE CVE-2021-41379 that include an msiexec process that creates an elevation_service.exe file

Read More
Potential PrintNightmare Exploitation Attempt

Sep 13, 2024 · attack.persistence attack.defense-evasion attack.privilege-escalation attack.t1574 cve.2021-1675 ·
Share on:

Detect DLL deletions from Spooler Service driver folder. This might be a potential exploitation attempt of CVE-2021-1675

Read More
Windows Spooler Service Suspicious Binary Load

Sep 13, 2024 · attack.persistence attack.defense-evasion attack.privilege-escalation attack.t1574 cve.2021-1675 cve.2021-34527 ·
Share on:

Detect DLL Load from Spooler Service backup folder

Read More
Startup/Logon Script Added to Group Policy Object

Sep 6, 2024 · attack.privilege-escalation attack.t1484.001 attack.t1547 ·
Share on:

Detects the modification of Group Policy Objects (GPO) to add a startup/logon script to users or computer objects.

Read More
Group Policy Abuse for Privilege Addition

Sep 6, 2024 · attack.privilege-escalation attack.t1484.001 ·
Share on:

Detects the first occurrence of a modification to Group Policy Object Attributes to add privileges to user accounts or use them to add users as local admins.

Read More
Certificate Use With No Strong Mapping

Sep 2, 2024 · attack.privilege-escalation ·
Share on:

Detects a user certificate that was valid but could not be mapped to a user in a strong way (such as via explicit mapping, key trust mapping, or a SID) This could be a sign of exploitation of the elevation of privilege vulnerabilities (CVE-2022-34691, CVE-2022-26931, CVE-2022-26923) that can occur when the KDC allows certificate spoofing by not requiring a strong mapping. Events where the AccountName and CN of the Subject do not match, or where the CN ends in a dollar sign indicating a machine, may indicate certificate spoofing.

Read More
Diamond Sleet APT Scheduled Task Creation

Sep 2, 2024 · attack.execution attack.privilege-escalation attack.persistence attack.t1053.005 detection.emerging-threats ·
Share on:

Detects registry event related to the creation of a scheduled task used by Diamond Sleet APT during exploitation of Team City CVE-2023-42793 vulnerability

Read More
Exploitation Indicators Of CVE-2023-20198

Sep 2, 2024 · attack.privilege-escalation attack.initial-access detection.emerging-threats ·
Share on:

Detecting exploitation indicators of CVE-2023-20198 a privilege escalation vulnerability in Cisco IOS XE Software Web UI.

Read More
HackTool - CoercedPotato Named Pipe Creation

Sep 2, 2024 · attack.defense-evasion attack.privilege-escalation attack.t1055 ·
Share on:

Detects the pattern of a pipe name as used by the hack tool CoercedPotato

Read More
Lazarus APT DLL Sideloading Activity

Sep 2, 2024 · attack.defense-evasion attack.privilege-escalation attack.t1574.001 attack.t1574.002 attack.g0032 detection.emerging-threats ·
Share on:

Detects sideloading of trojanized DLLs used in Lazarus APT campaign in the case of a Spanish aerospace company

Read More
Suspicious Sysmon as Execution Parent

Sep 2, 2024 · attack.privilege-escalation attack.t1068 cve.2022-41120 detection.emerging-threats ·
Share on:

Detects suspicious process executions in which Sysmon itself is the parent of a process, which could be a sign of exploitation (e.g. CVE-2022-41120)

Read More
Potential Privilege Escalation via Local Kerberos Relay over LDAP

Aug 29, 2024 · attack.privilege-escalation attack.credential-access attack.t1548 ·
Share on:

Detects a suspicious local successful logon event where the Logon Package is Kerberos, the remote address is set to localhost, and the target user SID is the built-in local Administrator account. This may indicate an attempt to leverage a Kerberos relay attack variant that can be used to elevate privilege locally from a domain joined limited user to local System privileges.

Read More
Suspicious Child Process Of Wermgr.EXE

Aug 29, 2024 · attack.defense-evasion attack.privilege-escalation attack.t1055 attack.t1036 ·
Share on:

Detects suspicious Windows Error Reporting manager (wermgr.exe) child process

Read More
Abuse of Service Permissions to Hide Services Via Set-Service

Aug 12, 2024 · attack.persistence attack.defense-evasion attack.privilege-escalation attack.t1574.011 ·
Share on:

Detects usage of the "Set-Service" powershell cmdlet to configure a new SecurityDescriptor that allows a service to be hidden from other utilities such as "sc.exe", "Get-Service"...etc. (Works only in powershell 7)

Read More
Abuse of Service Permissions to Hide Services Via Set-Service - PS

Aug 12, 2024 · attack.persistence attack.defense-evasion attack.privilege-escalation attack.t1574.011 ·
Share on:

Detects usage of the "Set-Service" powershell cmdlet to configure a new SecurityDescriptor that allows a service to be hidden from other utilities such as "sc.exe", "Get-Service"...etc. (Works only in powershell 7)

Read More
Abused Debug Privilege by Arbitrary Parent Processes

Aug 12, 2024 · attack.privilege-escalation attack.t1548 ·
Share on:

Detection of unusual child processes by different system processes

Read More
Account Tampering - Suspicious Failed Logon Reasons

Aug 12, 2024 · attack.persistence attack.defense-evasion attack.privilege-escalation attack.initial-access attack.t1078 ·
Share on:

This method uses uncommon error codes on failed logons to determine suspicious activity and tampering with accounts that have been disabled or somehow restricted.

Read More
Activity From Anonymous IP Address

Aug 12, 2024 · attack.t1078 attack.persistence attack.defense-evasion attack.privilege-escalation attack.initial-access ·
Share on:

Identifies that users were active from an IP address that has been identified as an anonymous proxy IP address.

Read More
ADCS Certificate Template Configuration Vulnerability

Aug 12, 2024 · attack.privilege-escalation attack.credential-access ·
Share on:

Detects certificate creation with template allowing risk permission subject

Read More
ADCS Certificate Template Configuration Vulnerability with Risky EKU

Aug 12, 2024 · attack.privilege-escalation attack.credential-access ·
Share on:

Detects certificate creation with template allowing risk permission subject and risky EKU

Read More
Addition of SID History to Active Directory Object

Aug 12, 2024 · attack.persistence attack.privilege-escalation attack.t1134.005 ·
Share on:

An attacker can use the SID history attribute to gain additional privileges.

Read More
Always Install Elevated MSI Spawned Cmd And Powershell

Aug 12, 2024 · attack.privilege-escalation attack.t1548.002 ·
Share on:

Detects Windows Installer service (msiexec.exe) spawning "cmd" or "powershell"

Read More
Antivirus PrinterNightmare CVE-2021-34527 Exploit Detection

Aug 12, 2024 · attack.privilege-escalation attack.t1055 ·
Share on:

Detects the suspicious file that is created from PoC code against Windows Print Spooler Remote Code Execution Vulnerability CVE-2021-34527 (PrinterNightmare), CVE-2021-1675 .

Read More
App Granted Privileged Delegated Or App Permissions

Aug 12, 2024 · attack.persistence attack.privilege-escalation attack.t1098.003 ·
Share on:

Detects when administrator grants either application permissions (app roles) or highly privileged delegated permissions

Read More
Application AppID Uri Configuration Changes

Aug 12, 2024 · attack.persistence attack.credential-access attack.privilege-escalation attack.t1552 attack.t1078.004 ·
Share on:

Detects when a configuration change is made to an applications AppID URI.

Read More
Application URI Configuration Changes

Aug 12, 2024 · attack.t1528 attack.t1078.004 attack.persistence attack.credential-access attack.privilege-escalation ·
Share on:

Detects when a configuration change is made to an applications URI. URIs for domain names that no longer exist (dangling URIs), not using HTTPS, wildcards at the end of the domain, URIs that are no unique to that app, or URIs that point to domains you do not control should be investigated.

Read More
Application Using Device Code Authentication Flow

Aug 12, 2024 · attack.t1078 attack.defense-evasion attack.persistence attack.privilege-escalation attack.initial-access ·
Share on:

Device code flow is an OAuth 2.0 protocol flow specifically for input constrained devices and is not used in all environments. If this type of flow is seen in the environment and not being used in an input constrained device scenario, further investigation is warranted. This can be a misconfigured application or potentially something malicious.

Read More
Applications That Are Using ROPC Authentication Flow

Aug 12, 2024 · attack.t1078 attack.defense-evasion attack.persistence attack.privilege-escalation attack.initial-access ·
Share on:

Resource owner password credentials (ROPC) should be avoided if at all possible as this requires the user to expose their current password credentials to the application directly. The application then uses those credentials to authenticate the user against the identity provider.

Read More
APT PRIVATELOG Image Load Pattern

Aug 12, 2024 · attack.defense-evasion attack.privilege-escalation attack.t1055 detection.emerging-threats ·
Share on:

Detects an image load pattern as seen when a tool named PRIVATELOG is used and rarely observed under legitimate circumstances

Read More
Aruba Network Service Potential DLL Sideloading

Aug 12, 2024 · attack.privilege-escalation attack.persistence attack.t1574.001 attack.t1574.002 ·
Share on:

Detects potential DLL sideloading activity via the Aruba Networks Virtual Intranet Access "arubanetsvc.exe" process using DLL Search Order Hijacking

Read More
Atypical Travel

Aug 12, 2024 · attack.t1078 attack.persistence attack.defense-evasion attack.privilege-escalation attack.initial-access ·
Share on:

Identifies two sign-ins originating from geographically distant locations, where at least one of the locations may also be atypical for the user, given past behavior.

Read More
Audit CVE Event

Aug 12, 2024 · attack.execution attack.t1203 attack.privilege-escalation attack.t1068 attack.defense-evasion attack.t1211 attack.credential-access attack.t1212 attack.lateral-movement attack.t1210 attack.impact attack.t1499.004 ·
Share on:

Detects events generated by user-mode applications when they call the CveEventWrite API when a known vulnerability is trying to be exploited. MS started using this log in Jan. 2020 with CVE-2020-0601 (a Windows CryptoAPI vulnerability. Unfortunately, that is about the only instance of CVEs being written to this log.

Read More
AWS Attached Malicious Lambda Layer

Aug 12, 2024 · attack.privilege-escalation ·
Share on:

Detects when an user attached a Lambda layer to an existing function to override a library that is in use by the function, where their malicious code could utilize the function's IAM role for AWS API calls. This would give an adversary access to the privileges associated with the Lambda service role that is attached to that function.

Read More
AWS Glue Development Endpoint Activity

Aug 12, 2024 · attack.privilege-escalation ·
Share on:

Detects possible suspicious glue development endpoint activity.

Read More
AWS Root Credentials

Aug 12, 2024 · attack.privilege-escalation attack.t1078.004 ·
Share on:

Detects AWS root account usage

Read More
AWS STS AssumeRole Misuse

Aug 12, 2024 · attack.lateral-movement attack.privilege-escalation attack.t1548 attack.t1550 attack.t1550.001 ·
Share on:

Identifies the suspicious use of AssumeRole. Attackers could move laterally and escalate privileges.

Read More
AWS STS GetSessionToken Misuse

Aug 12, 2024 · attack.lateral-movement attack.privilege-escalation attack.t1548 attack.t1550 attack.t1550.001 ·
Share on:

Identifies the suspicious use of GetSessionToken. Tokens could be created and used by attackers to move laterally and escalate privileges.

Read More
AWS Suspicious SAML Activity

Aug 12, 2024 · attack.initial-access attack.t1078 attack.lateral-movement attack.t1548 attack.privilege-escalation attack.t1550 attack.t1550.001 ·
Share on:

Identifies when suspicious SAML activity has occurred in AWS. An adversary could gain backdoor access via SAML.

Read More
Azure AD Threat Intelligence

Aug 12, 2024 · attack.t1078 attack.persistence attack.defense-evasion attack.privilege-escalation attack.initial-access ·
Share on:

Indicates user activity that is unusual for the user or consistent with known attack patterns.

Read More
Azure Kubernetes CronJob

Aug 12, 2024 · attack.persistence attack.t1053.003 attack.privilege-escalation attack.execution ·
Share on:

Identifies when a Azure Kubernetes CronJob runs in Azure Cloud. Kubernetes Job is a controller that creates one or more pods and ensures that a specified number of them successfully terminate. Kubernetes Job can be used to run containers that perform finite tasks for batch jobs. Kubernetes CronJob is used to schedule Jobs. An Adversary may use Kubernetes CronJob for scheduling execution of malicious code that would run as a container in the cluster.

Read More
Bitbucket Global Permission Changed

Aug 12, 2024 · attack.persistence attack.privilege-escalation attack.t1098 ·
Share on:

Detects global permissions change activity.

Read More
Buffer Overflow Attempts

Aug 12, 2024 · attack.t1068 attack.privilege-escalation ·
Share on:

Detects buffer overflow attempts in Unix system log files

Read More
Bypass UAC Using DelegateExecute

Aug 12, 2024 · attack.privilege-escalation attack.defense-evasion attack.t1548.002 ·
Share on:

Bypasses User Account Control using a fileless method

Read More
Bypass UAC Using SilentCleanup Task

Aug 12, 2024 · attack.privilege-escalation attack.defense-evasion attack.t1548.002 ·
Share on:

Detects the setting of the environement variable "windir" to a non default value. Attackers often abuse this variable in order to trigger a UAC bypass via the "SilentCleanup" task. The SilentCleanup task located in %windir%\system32\cleanmgr.exe is an auto-elevated task that can be abused to elevate any file with administrator privileges without prompting UAC.

Read More
Bypass UAC via CMSTP

Aug 12, 2024 · attack.privilege-escalation attack.defense-evasion attack.t1548.002 attack.t1218.003 ·
Share on:

Detect commandline usage of Microsoft Connection Manager Profile Installer (cmstp.exe) to install specially formatted local .INF files

Read More
Bypass UAC via Fodhelper.exe

Aug 12, 2024 · attack.privilege-escalation attack.t1548.002 ·
Share on:

Identifies use of Fodhelper.exe to bypass User Account Control. Adversaries use this technique to execute privileged processes.

Read More
Bypass UAC via WSReset.exe

Aug 12, 2024 · attack.privilege-escalation attack.defense-evasion attack.t1548.002 ·
Share on:

Detects use of WSReset.exe to bypass User Account Control (UAC). Adversaries use this technique to execute privileged processes.

Read More
Certificate-Based Authentication Enabled

Aug 12, 2024 · attack.persistence attack.privilege-escalation attack.t1556 ·
Share on:

Detects when certificate based authentication has been enabled in an Azure Active Directory tenant.

Read More
Changes to Device Registration Policy

Aug 12, 2024 · attack.defense-evasion attack.privilege-escalation attack.t1484 ·
Share on:

Monitor and alert for changes to the device registration policy.

Read More
Changes To PIM Settings

Aug 12, 2024 · attack.privilege-escalation attack.persistence attack.t1078.004 ·
Share on:

Detects when changes are made to PIM roles

Read More
Cisco BGP Authentication Failures

Aug 12, 2024 · attack.initial-access attack.persistence attack.privilege-escalation attack.defense-evasion attack.credential-access attack.collection attack.t1078 attack.t1110 attack.t1557 ·
Share on:

Detects BGP failures which may be indicative of brute force attacks to manipulate routing

Read More
Cisco LDP Authentication Failures

Aug 12, 2024 · attack.initial-access attack.persistence attack.privilege-escalation attack.defense-evasion attack.credential-access attack.collection attack.t1078 attack.t1110 attack.t1557 ·
Share on:

Detects LDP failures which may be indicative of brute force attacks to manipulate MPLS labels

Read More
CobaltStrike Named Pipe

Aug 12, 2024 · attack.defense-evasion attack.privilege-escalation attack.t1055 ·
Share on:

Detects the creation of a named pipe as used by CobaltStrike

Read More
CobaltStrike Named Pipe Pattern Regex

Aug 12, 2024 · attack.defense-evasion attack.privilege-escalation attack.t1055 ·
Share on:

Detects the creation of a named pipe matching a pattern used by CobaltStrike Malleable C2 profiles

Read More
CobaltStrike Named Pipe Patterns

Aug 12, 2024 · attack.defense-evasion attack.privilege-escalation attack.t1055 stp.1k ·
Share on:

Detects the creation of a named pipe with a pattern found in CobaltStrike malleable C2 profiles

Read More
CobaltStrike Service Installations - Security

Aug 12, 2024 · attack.execution attack.privilege-escalation attack.lateral-movement attack.t1021.002 attack.t1543.003 attack.t1569.002 ·
Share on:

Detects known malicious service installs that appear in cases in which a Cobalt Strike beacon elevates privileges or lateral movement

Read More
CobaltStrike Service Installations - System

Aug 12, 2024 · attack.execution attack.privilege-escalation attack.lateral-movement attack.t1021.002 attack.t1543.003 attack.t1569.002 ·
Share on:

Detects known malicious service installs that appear in cases in which a Cobalt Strike beacon elevates privileges or lateral movement

Read More
Code Injection by ld.so Preload

Aug 12, 2024 · attack.persistence attack.privilege-escalation attack.t1574.006 ·
Share on:

Detects the ld.so preload persistence file. See man ld.so for more information.

Read More
CodeIntegrity - Blocked Driver Load With Revoked Certificate

Aug 12, 2024 · attack.privilege-escalation attack.t1543 ·
Share on:

Detects blocked load attempts of revoked drivers

Read More
CodeIntegrity - Blocked Image Load With Revoked Certificate

Aug 12, 2024 · attack.privilege-escalation ·
Share on:

Detects blocked image load events with revoked certificates by code integrity.

Read More
CodeIntegrity - Blocked Image/Driver Load For Policy Violation

Aug 12, 2024 · attack.privilege-escalation attack.t1543 ·
Share on:

Detects blocked load events that did not meet the authenticode signing level requirements or violated the code integrity policy.

Read More
CodeIntegrity - Disallowed File For Protected Processes Has Been Blocked

Aug 12, 2024 · attack.privilege-escalation ·
Share on:

Detects block events for files that are disallowed by code integrity for protected processes

Read More
CodeIntegrity - Revoked Image Loaded

Aug 12, 2024 · attack.privilege-escalation ·
Share on:

Detects image load events with revoked certificates by code integrity.

Read More
CodeIntegrity - Revoked Kernel Driver Loaded

Aug 12, 2024 · attack.privilege-escalation ·
Share on:

Detects the load of a revoked kernel driver

Read More
CodeIntegrity - Unmet WHQL Requirements For Loaded Kernel Module

Aug 12, 2024 · attack.privilege-escalation ·
Share on:

Detects loaded kernel modules that did not meet the WHQL signing requirements.

Read More
CodeIntegrity - Unsigned Image Loaded

Aug 12, 2024 · attack.privilege-escalation ·
Share on:

Detects loaded unsigned image on the system

Read More
CodeIntegrity - Unsigned Kernel Module Loaded

Aug 12, 2024 · attack.privilege-escalation ·
Share on:

Detects the presence of a loaded unsigned kernel module on the system.

Read More
COM Hijack via Sdclt

Aug 12, 2024 · attack.privilege-escalation attack.t1546 attack.t1548 ·
Share on:

Detects changes to 'HKCU\Software\Classes\Folder\shell\open\command\DelegateExecute'

Read More
Creation Of Non-Existent System DLL

Aug 12, 2024 · attack.defense-evasion attack.persistence attack.privilege-escalation attack.t1574.001 attack.t1574.002 ·
Share on:

Detects the creation of system DLLs that are usually not present on the system (or at least not in system directories). Usually this technique is used to achieve DLL hijacking.

Read More
CVE-2022-24527 Microsoft Connected Cache LPE

Aug 12, 2024 · attack.privilege-escalation attack.t1059.001 cve.2022-24527 detection.emerging-threats ·
Share on:

Detects files created during the local privilege exploitation of CVE-2022-24527 Microsoft Connected Cache

Read More
DiagTrackEoP Default Login Username

Aug 12, 2024 · attack.privilege-escalation ·
Share on:

Detects the default "UserName" used by the DiagTrackEoP POC

Read More
DLL Search Order Hijackig Via Additional Space in Path

Aug 12, 2024 · attack.persistence attack.privilege-escalation attack.defense-evasion attack.t1574.002 ·
Share on:

Detects when an attacker create a similar folder structure to windows system folders such as (Windows, Program Files...) but with a space in order to trick DLL load search order and perform a "DLL Search Order Hijacking" attack

Read More
DLL Sideloading Of ShellChromeAPI.DLL

Aug 12, 2024 · attack.defense-evasion attack.persistence attack.privilege-escalation attack.t1574.001 attack.t1574.002 ·
Share on:

Detects processes loading the non-existent DLL "ShellChromeAPI". One known example is the "DeviceEnroller" binary in combination with the "PhoneDeepLink" flag tries to load this DLL. Adversaries can drop their own renamed DLL and execute it via DeviceEnroller.exe using this parameter

Read More
DotNet CLR DLL Loaded By Scripting Applications

Aug 12, 2024 · attack.execution attack.privilege-escalation attack.t1055 ·
Share on:

Detects .NET CLR DLLs being loaded by scripting applications such as wscript or cscript. This could be an indication of potential suspicious execution.

Read More
Driver Load From A Temporary Directory

Aug 12, 2024 · attack.persistence attack.privilege-escalation attack.t1543.003 ·
Share on:

Detects a driver load from a temporary directory

Read More
Enabling COR Profiler Environment Variables

Aug 12, 2024 · attack.persistence attack.privilege-escalation attack.defense-evasion attack.t1574.012 ·
Share on:

Detects .NET Framework CLR and .NET Core CLR "cor_enable_profiling" and "cor_profiler" variables being set and configured.

Read More
Exploiting SetupComplete.cmd CVE-2019-1378

Aug 12, 2024 · attack.privilege-escalation attack.t1068 attack.execution attack.t1059.003 attack.t1574 cve.2019-1378 detection.emerging-threats ·
Share on:

Detects exploitation attempt of privilege escalation vulnerability via SetupComplete.cmd and PartnerSetupComplete.cmd described in CVE-2019-1378

Read More
Function Call From Undocumented COM Interface EditionUpgradeManager

Aug 12, 2024 · attack.defense-evasion attack.privilege-escalation attack.t1548.002 ·
Share on:

Detects function calls from the EditionUpgradeManager COM interface. Which is an interface that is not used by standard executables.

Read More
Github New Secret Created

Aug 12, 2024 · attack.defense-evasion attack.persistence attack.privilege-escalation attack.initial-access attack.t1078.004 ·
Share on:

Detects when a user creates action secret for the organization, environment, codespaces or repository.

Read More
Github Self Hosted Runner Changes Detected

Aug 12, 2024 · attack.impact attack.discovery attack.collection attack.defense-evasion attack.persistence attack.privilege-escalation attack.initial-access attack.t1526 attack.t1213.003 attack.t1078.004 ·
Share on:

A self-hosted runner is a system that you deploy and manage to execute jobs from GitHub Actions on GitHub.com. This rule detects changes to self-hosted runners configurations in the environment. The self-hosted runner configuration changes once detected, it should be validated from GitHub UI because the log entry may not provide full context.

Read More
Github SSH Certificate Configuration Changed

Aug 12, 2024 · attack.persistence attack.privilege-escalation attack.t1078.004 ·
Share on:

Detects when changes are made to the SSH certificate configuration of the organization.

Read More
Google Cloud Kubernetes CronJob

Aug 12, 2024 · attack.persistence attack.privilege-escalation attack.execution ·
Share on:

Identifies when a Google Cloud Kubernetes CronJob runs in Azure Cloud. Kubernetes Job is a controller that creates one or more pods and ensures that a specified number of them successfully terminate. Kubernetes Job can be used to run containers that perform finite tasks for batch jobs. Kubernetes CronJob is used to schedule Jobs. An Adversary may use Kubernetes CronJob for scheduling execution of malicious code that would run as a container in the cluster.

Read More
HackTool - CrackMapExec Execution

Aug 12, 2024 · attack.execution attack.persistence attack.privilege-escalation attack.credential-access attack.discovery attack.t1047 attack.t1053 attack.t1059.003 attack.t1059.001 attack.t1110 attack.t1201 ·
Share on:

This rule detect common flag combinations used by CrackMapExec in order to detect its use even if the binary has been replaced.

Read More
HackTool - Default PowerSploit/Empire Scheduled Task Creation

Aug 12, 2024 · attack.execution attack.persistence attack.privilege-escalation attack.s0111 attack.g0022 attack.g0060 car.2013-08-001 attack.t1053.005 attack.t1059.001 ·
Share on:

Detects the creation of a schtask via PowerSploit or Empire Default Configuration.

Read More
HackTool - DiagTrackEoP Default Named Pipe

Aug 12, 2024 · attack.privilege-escalation ·
Share on:

Detects creation of default named pipe used by the DiagTrackEoP POC, a tool that abuses "SeImpersonate" privilege.

Read More
HackTool - Empire PowerShell UAC Bypass

Aug 12, 2024 · attack.defense-evasion attack.privilege-escalation attack.t1548.002 car.2019-04-001 ·
Share on:

Detects some Empire PowerShell UAC bypass methods

Read More
HackTool - Koh Default Named Pipe

Aug 12, 2024 · attack.privilege-escalation attack.credential-access attack.t1528 attack.t1134.001 ·
Share on:

Detects creation of default named pipes used by the Koh tool

Read More
HackTool - Powerup Write Hijack DLL

Aug 12, 2024 · attack.persistence attack.privilege-escalation attack.defense-evasion attack.t1574.001 ·
Share on:

Powerup tool's Write Hijack DLL exploits DLL hijacking for privilege escalation. In it's default mode, it builds a self deleting .bat file which executes malicious command. The detection rule relies on creation of the malicious bat file (debug.bat by default).

Read More
HackTool - SharpDPAPI Execution

Aug 12, 2024 · attack.privilege-escalation attack.defense-evasion attack.t1134.001 attack.t1134.003 ·
Share on:

Detects the execution of the SharpDPAPI tool based on CommandLine flags and PE metadata. SharpDPAPI is a C# port of some DPAPI functionality from the Mimikatz project.

Read More
HackTool - SharpImpersonation Execution

Aug 12, 2024 · attack.privilege-escalation attack.defense-evasion attack.t1134.001 attack.t1134.003 ·
Share on:

Detects execution of the SharpImpersonation tool. Which can be used to manipulate tokens on a Windows computers remotely (PsExec/WmiExec) or interactively

Read More
HackTool - SharpUp PrivEsc Tool Execution

Aug 12, 2024 · attack.privilege-escalation attack.t1615 attack.t1569.002 attack.t1574.005 ·
Share on:

Detects the use of SharpUp, a tool for local privilege escalation

Read More
HackTool - winPEAS Execution

Aug 12, 2024 · attack.privilege-escalation attack.t1082 attack.t1087 attack.t1046 ·
Share on:

WinPEAS is a script that search for possible paths to escalate privileges on Windows hosts. The checks are explained on book.hacktricks.xyz

Read More
Huawei BGP Authentication Failures

Aug 12, 2024 · attack.initial-access attack.persistence attack.privilege-escalation attack.defense-evasion attack.credential-access attack.collection attack.t1078 attack.t1110 attack.t1557 ·
Share on:

Detects BGP failures which may be indicative of brute force attacks to manipulate routing.

Read More
Important Scheduled Task Deleted/Disabled

Aug 12, 2024 · attack.execution attack.privilege-escalation attack.persistence attack.t1053.005 ·
Share on:

Detects when adversaries stop services or processes by deleting or disabling their respective scheduled tasks in order to conduct data destructive activities

Read More
Impossible Travel

Aug 12, 2024 · attack.t1078 attack.persistence attack.defense-evasion attack.privilege-escalation attack.initial-access ·
Share on:

Identifies user activities originating from geographically distant locations within a time period shorter than the time it takes to travel from the first location to the second.

Read More
Interactive AT Job

Aug 12, 2024 · attack.privilege-escalation attack.t1053.002 ·
Share on:

Detects an interactive AT job, which may be used as a form of privilege escalation.

Read More
Invalid PIM License

Aug 12, 2024 · attack.t1078 attack.persistence attack.privilege-escalation ·
Share on:

Identifies when an organization doesn't have the proper license for PIM and is out of compliance.

Read More
Juniper BGP Missing MD5

Aug 12, 2024 · attack.initial-access attack.persistence attack.privilege-escalation attack.defense-evasion attack.credential-access attack.collection attack.t1078 attack.t1110 attack.t1557 ·
Share on:

Detects juniper BGP missing MD5 digest. Which may be indicative of brute force attacks to manipulate routing.

Read More
Kapeka Backdoor Scheduled Task Creation

Aug 12, 2024 · attack.execution attack.privilege-escalation attack.persistence attack.t1053.005 ·
Share on:

Detects Kapeka backdoor scheduled task creation based on attributes such as paths, commands line flags, etc.

Read More
KDC RC4-HMAC Downgrade CVE-2022-37966

Aug 12, 2024 · attack.privilege-escalation ·
Share on:

Detects the exploitation of a security bypass and elevation of privilege vulnerability with Authentication Negotiation by using weak RC4-HMAC negotiation

Read More
KrbRelayUp Service Installation

Aug 12, 2024 · attack.privilege-escalation attack.t1543 ·
Share on:

Detects service creation from KrbRelayUp tool used for privilege escalation in Windows domain environments where LDAP signing is not enforced (the default settings)

Read More
Kubernetes CronJob/Job Modification

Aug 12, 2024 · attack.persistence attack.privilege-escalation attack.execution ·
Share on:

Detects when a Kubernetes CronJob or Job is created or modified. A Kubernetes Job creates one or more pods to accomplish a specific task, and a CronJob creates Jobs on a recurring schedule. An adversary can take advantage of this Kubernetes object to schedule Jobs to run containers that execute malicious code within a cluster, allowing them to achieve persistence.

Read More
Kubernetes Rolebinding Modification

Aug 12, 2024 · attack.privilege-escalation ·
Share on:

Detects when a Kubernetes Rolebinding is created or modified.

Read More
Kubernetes Unauthorized or Unauthenticated Access

Aug 12, 2024 · attack.privilege-escalation ·
Share on:

Detects when a request to the Kubernetes API is rejected due to lack of authorization or due to an expired authentication token being used. This may indicate an attacker attempting to leverage credentials they have obtained.

Read More
Linux Capabilities Discovery

Aug 12, 2024 · attack.collection attack.privilege-escalation attack.t1123 attack.t1548 ·
Share on:

Detects attempts to discover the files with setuid/setgid capability on them. That would allow adversary to escalate their privileges.

Read More
Linux Doas Conf File Creation

Aug 12, 2024 · attack.privilege-escalation attack.t1548 ·
Share on:

Detects the creation of doas.conf file in linux host platform.

Read More
Linux Doas Tool Execution

Aug 12, 2024 · attack.privilege-escalation attack.t1548 ·
Share on:

Detects the doas tool execution in linux host platform. This utility tool allow standard users to perform tasks as root, the same way sudo does.

Read More
LiveKD Driver Creation

Aug 12, 2024 · attack.defense-evasion attack.privilege-escalation ·
Share on:

Detects the creation of the LiveKD driver, which is used for live kernel debugging

Read More
LiveKD Driver Creation By Uncommon Process

Aug 12, 2024 · attack.defense-evasion attack.privilege-escalation ·
Share on:

Detects the creation of the LiveKD driver by a process image other than "livekd.exe".

Read More
LiveKD Kernel Memory Dump File Created

Aug 12, 2024 · attack.defense-evasion attack.privilege-escalation ·
Share on:

Detects the creation of a file that has the same name as the default LiveKD kernel memory dump.

Read More
Loading of Kernel Module via Insmod

Aug 12, 2024 · attack.persistence attack.privilege-escalation attack.t1547.006 ·
Share on:

Detects loading of kernel modules with insmod command. Loadable Kernel Modules (LKMs) are pieces of code that can be loaded and unloaded into the kernel upon demand. Adversaries may use LKMs to obtain persistence within the system or elevate the privileges.

Read More
MacOS Emond Launch Daemon

Aug 12, 2024 · attack.persistence attack.privilege-escalation attack.t1546.014 ·
Share on:

Detects additions to the Emond Launch Daemon that adversaries may use to gain persistence and elevate privileges.

Read More
Malicious DLL File Dropped in the Teams or OneDrive Folder

Aug 12, 2024 · attack.persistence attack.privilege-escalation attack.defense-evasion attack.t1574.002 ·
Share on:

Detects creation of a malicious DLL file in the location where the OneDrive or Team applications Upon execution of the Teams or OneDrive application, the dropped malicious DLL file ("iphlpapi.dll") is sideloaded

Read More
Malicious Named Pipe Created

Aug 12, 2024 · attack.defense-evasion attack.privilege-escalation attack.t1055 ·
Share on:

Detects the creation of a named pipe seen used by known APTs or malware.

Read More
Malicious Usage Of IMDS Credentials Outside Of AWS Infrastructure

Aug 12, 2024 · attack.privilege-escalation attack.defense-evasion attack.t1078 attack.t1078.002 ·
Share on:

Detects when an instance identity has taken an action that isn't inside SSM. This can indicate that a compromised EC2 instance is being used as a pivot point.

Read More
Malware Shellcode in Verclsid Target Process

Aug 12, 2024 · attack.defense-evasion attack.privilege-escalation attack.t1055 detection.emerging-threats ·
Share on:

Detects a process access to verclsid.exe that injects shellcode from a Microsoft Office application / VBA macro

Read More
Mavinject Inject DLL Into Running Process

Aug 12, 2024 · attack.defense-evasion attack.privilege-escalation attack.t1055.001 attack.t1218.013 ·
Share on:

Detects process injection using the signed Windows tool "Mavinject" via the "INJECTRUNNING" flag

Read More
Meterpreter or Cobalt Strike Getsystem Service Installation - Security

Aug 12, 2024 · attack.privilege-escalation attack.t1134.001 attack.t1134.002 ·
Share on:

Detects the use of getsystem Meterpreter/Cobalt Strike command by detecting a specific service installation

Read More
Meterpreter or Cobalt Strike Getsystem Service Installation - System

Aug 12, 2024 · attack.privilege-escalation attack.t1134.001 attack.t1134.002 ·
Share on:

Detects the use of getsystem Meterpreter/Cobalt Strike command by detecting a specific service installation

Read More
Microsoft Office DLL Sideload

Aug 12, 2024 · attack.defense-evasion attack.persistence attack.privilege-escalation attack.t1574.001 attack.t1574.002 ·
Share on:

Detects DLL sideloading of DLLs that are part of Microsoft Office from non standard location

Read More
Modify Group Policy Settings

Aug 12, 2024 · attack.defense-evasion attack.privilege-escalation attack.t1484.001 ·
Share on:

Detect malicious GPO modifications can be used to implement many other malicious behaviors.

Read More
Modify Group Policy Settings - ScriptBlockLogging

Aug 12, 2024 · attack.defense-evasion attack.privilege-escalation attack.t1484.001 ·
Share on:

Detect malicious GPO modifications can be used to implement many other malicious behaviors.

Read More
Modify User Shell Folders Startup Value

Aug 12, 2024 · attack.persistence attack.privilege-escalation attack.t1547.001 ·
Share on:

Detect modification of the startup key to a path where a payload could be stored to be launched during startup

Read More
Moriya Rootkit - System

Aug 12, 2024 · attack.persistence attack.privilege-escalation attack.t1543.003 ·
Share on:

Detects the use of Moriya rootkit as described in the securelist's Operation TunnelSnake report

Read More
Moriya Rootkit File Created

Aug 12, 2024 · attack.persistence attack.privilege-escalation attack.t1543.003 detection.emerging-threats ·
Share on:

Detects the creation of a file named "MoriyaStreamWatchmen.sys" in a specific location. This filename was reported to be related to the Moriya rootkit as described in the securelist's Operation TunnelSnake report.

Read More
New Country

Aug 12, 2024 · attack.t1078 attack.persistence attack.defense-evasion attack.privilege-escalation attack.initial-access ·
Share on:

Detects sign-ins from new countries. The detection considers past activity locations to determine new and infrequent locations.

Read More
New Kernel Driver Via SC.EXE

Aug 12, 2024 · attack.persistence attack.privilege-escalation attack.t1543.003 ·
Share on:

Detects creation of a new service (kernel driver) with the type "kernel"

Read More
New PDQDeploy Service - Client Side

Aug 12, 2024 · attack.privilege-escalation attack.t1543.003 ·
Share on:

Detects PDQDeploy service installation on the target system. When a package is deployed via PDQDeploy it installs a remote service on the target machine with the name "PDQDeployRunner-X" where "X" is an integer starting from 1

Read More
New PDQDeploy Service - Server Side

Aug 12, 2024 · attack.privilege-escalation attack.t1543.003 ·
Share on:

Detects a PDQDeploy service installation which indicates that PDQDeploy was installed on the machines. PDQDeploy can be abused by attackers to remotely install packages or execute commands on target machines

Read More
New Root Certificate Authority Added

Aug 12, 2024 · attack.persistence attack.privilege-escalation attack.t1556 ·
Share on:

Detects newly added root certificate authority to an AzureAD tenant to support certificate based authentication.

Read More
New Service Creation Using PowerShell

Aug 12, 2024 · attack.persistence attack.privilege-escalation attack.t1543.003 ·
Share on:

Detects the creation of a new service using powershell.

Read More
New Service Creation Using Sc.EXE

Aug 12, 2024 · attack.persistence attack.privilege-escalation attack.t1543.003 ·
Share on:

Detects the creation of a new service using the "sc.exe" utility.

Read More
New TimeProviders Registered With Uncommon DLL Name

Aug 12, 2024 · attack.persistence attack.privilege-escalation attack.t1547.003 ·
Share on:

Detects processes setting a new DLL in DllName in under HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\W32Time\TimeProvider. Adversaries may abuse time providers to execute DLLs when the system boots. The Windows Time service (W32Time) enables time synchronization across and within domains.

Read More
Nimbuspwn Exploitation

Aug 12, 2024 · attack.privilege-escalation attack.t1068 ·
Share on:

Detects exploitation of Nimbuspwn privilege escalation vulnerability (CVE-2022-29799 and CVE-2022-29800)

Read More
OMIGOD HTTP No Authentication RCE

Aug 12, 2024 · attack.privilege-escalation attack.initial-access attack.execution attack.lateral-movement attack.t1068 attack.t1190 attack.t1203 attack.t1021.006 attack.t1210 ·
Share on:

Detects the exploitation of OMIGOD (CVE-2021-38647) which allows remote execute (RCE) commands as root with just a single unauthenticated HTTP request. Verify, successful, exploitation by viewing the HTTP client (request) body to see what was passed to the server (using PCAP). Within the client body is where the code execution would occur. Additionally, check the endpoint logs to see if suspicious commands or activity occurred within the timeframe of this HTTP request.

Read More
OMIGOD SCX RunAsProvider ExecuteScript

Aug 12, 2024 · attack.privilege-escalation attack.initial-access attack.execution attack.t1068 attack.t1190 attack.t1203 ·
Share on:

Rule to detect the use of the SCX RunAsProvider ExecuteScript to execute any UNIX/Linux script using the /bin/sh shell. Script being executed gets created as a temp file in /tmp folder with a scx* prefix. Then it is invoked from the following directory /etc/opt/microsoft/scx/conf/tmpdir/. The file in that directory has the same prefix scx*. SCXcore, started as the Microsoft Operations Manager UNIX/Linux Agent, is now used in a host of products including Microsoft Operations Manager, Microsoft Azure, and Microsoft Operations Management Suite.

Read More
OMIGOD SCX RunAsProvider ExecuteShellCommand

Aug 12, 2024 · attack.privilege-escalation attack.initial-access attack.execution attack.t1068 attack.t1190 attack.t1203 ·
Share on:

Rule to detect the use of the SCX RunAsProvider Invoke_ExecuteShellCommand to execute any UNIX/Linux command using the /bin/sh shell. SCXcore, started as the Microsoft Operations Manager UNIX/Linux Agent, is now used in a host of products including Microsoft Operations Manager, Microsoft Azure, and Microsoft Operations Management Suite.

Read More
Password Provided In Command Line Of Net.EXE

Aug 12, 2024 · attack.defense-evasion attack.initial-access attack.persistence attack.privilege-escalation attack.lateral-movement attack.t1021.002 attack.t1078 ·
Share on:

Detects a when net.exe is called with a password in the command line

Read More
Path To Screensaver Binary Modified

Aug 12, 2024 · attack.persistence attack.privilege-escalation attack.t1546.002 ·
Share on:

Detects value modification of registry key containing path to binary used as screensaver.

Read More
Persistence Via Sticky Key Backdoor

Aug 12, 2024 · attack.t1546.008 attack.privilege-escalation ·
Share on:

By replacing the sticky keys executable with the local admins CMD executable, an attacker is able to access a privileged windows console session without authenticating to the system. When the sticky keys are "activated" the privilleged shell is launched.

Read More
PIM Alert Setting Changes To Disabled

Aug 12, 2024 · attack.persistence attack.privilege-escalation attack.t1078 ·
Share on:

Detects when PIM alerts are set to disabled.

Read More
PIM Approvals And Deny Elevation

Aug 12, 2024 · attack.privilege-escalation attack.t1078.004 ·
Share on:

Detects when a PIM elevation is approved or denied. Outside of normal operations should be investigated.

Read More
Possible Coin Miner CPU Priority Param

Aug 12, 2024 · attack.privilege-escalation attack.t1068 ·
Share on:

Detects command line parameter very often used with coin miners

Read More
Potential 7za.DLL Sideloading

Aug 12, 2024 · attack.defense-evasion attack.persistence attack.privilege-escalation attack.t1574.001 attack.t1574.002 ·
Share on:

Detects potential DLL sideloading of "7za.dll"

Read More
Potential Access Token Abuse

Aug 12, 2024 · attack.defense-evasion attack.privilege-escalation attack.t1134.001 stp.4u ·
Share on:

Detects potential token impersonation and theft. Example, when using "DuplicateToken(Ex)" and "ImpersonateLoggedOnUser" with the "LOGON32_LOGON_NEW_CREDENTIALS flag".

Read More
Potential Antivirus Software DLL Sideloading

Aug 12, 2024 · attack.defense-evasion attack.persistence attack.privilege-escalation attack.t1574.001 attack.t1574.002 ·
Share on:

Detects potential DLL sideloading of DLLs that are part of antivirus software suchas McAfee, Symantec...etc

Read More
Potential appverifUI.DLL Sideloading

Aug 12, 2024 · attack.defense-evasion attack.privilege-escalation attack.t1574.001 attack.t1574.002 ·
Share on:

Detects potential DLL sideloading of "appverifUI.dll"

Read More
Potential AVKkid.DLL Sideloading

Aug 12, 2024 · attack.defense-evasion attack.privilege-escalation attack.t1574.001 attack.t1574.002 ·
Share on:

Detects potential DLL sideloading of "AVKkid.dll"

Read More
Potential Azure Browser SSO Abuse

Aug 12, 2024 · attack.defense-evasion attack.privilege-escalation attack.t1574.002 ·
Share on:

Detects abusing Azure Browser SSO by requesting OAuth 2.0 refresh tokens for an Azure-AD-authenticated Windows user (i.e. the machine is joined to Azure AD and a user logs in with their Azure AD account) wanting to perform SSO authentication in the browser. An attacker can use this to authenticate to Azure AD in a browser as that user.

Read More
Potential BearLPE Exploitation

Aug 12, 2024 · attack.privilege-escalation attack.t1053.005 car.2013-08-001 detection.emerging-threats ·
Share on:

Detects potential exploitation of the BearLPE exploit using Task Scheduler ".job" import arbitrary DACL write\par

Read More
Potential CCleanerDU.DLL Sideloading

Aug 12, 2024 · attack.defense-evasion attack.persistence attack.privilege-escalation attack.t1574.001 attack.t1574.002 ·
Share on:

Detects potential DLL sideloading of "CCleanerDU.dll"

Read More
Potential CCleanerReactivator.DLL Sideloading

Aug 12, 2024 · attack.defense-evasion attack.persistence attack.privilege-escalation attack.t1574.001 attack.t1574.002 ·
Share on:

Detects potential DLL sideloading of "CCleanerReactivator.dll"

Read More
Potential Chrome Frame Helper DLL Sideloading

Aug 12, 2024 · attack.defense-evasion attack.persistence attack.privilege-escalation attack.t1574.001 attack.t1574.002 ·
Share on:

Detects potential DLL sideloading of "chrome_frame_helper.dll"

Read More
Potential CobaltStrike Service Installations - Registry

Aug 12, 2024 · attack.execution attack.privilege-escalation attack.lateral-movement attack.t1021.002 attack.t1543.003 attack.t1569.002 ·
Share on:

Detects known malicious service installs that appear in cases in which a Cobalt Strike beacon elevates privileges or lateral movement.

Read More
Potential CVE-2023-21554 QueueJumper Exploitation

Aug 12, 2024 · attack.privilege-escalation attack.execution cve.2023-21554 detection.emerging-threats ·
Share on:

Detects potential exploitation of CVE-2023-21554 (dubbed QueueJumper)

Read More
Potential CVE-2024-3400 Exploitation - Palo Alto GlobalProtect OS Command Injection

Aug 12, 2024 · attack.initial-access attack.persistence attack.privilege-escalation attack.defense-evasion cve.2024-3400 ·
Share on:

Detects potential exploitation attempts of CVE-2024-3400 - an OS command injection in Palo Alto GlobalProtect. This detection looks for suspicious strings that indicate a potential directory traversal attempt or command injection.

Read More
Potential DLL Sideloading Of DBGCORE.DLL

Aug 12, 2024 · attack.defense-evasion attack.persistence attack.privilege-escalation attack.t1574.001 attack.t1574.002 ·
Share on:

Detects DLL sideloading of "dbgcore.dll"

Read More
Potential DLL Sideloading Of DBGHELP.DLL

Aug 12, 2024 · attack.defense-evasion attack.persistence attack.privilege-escalation attack.t1574.001 attack.t1574.002 ·
Share on:

Detects potential DLL sideloading of "dbghelp.dll"

Read More
Potential DLL Sideloading Of KeyScramblerIE.DLL Via KeyScrambler.EXE

Aug 12, 2024 · attack.defense-evasion attack.privilege-escalation attack.t1574.001 attack.t1574.002 ·
Share on:

Detects potential DLL side loading of "KeyScramblerIE.dll" by "KeyScrambler.exe". Various threat actors and malware have been found side loading a masqueraded "KeyScramblerIE.dll" through "KeyScrambler.exe".

Read More
Potential DLL Sideloading Of Libcurl.DLL Via GUP.EXE

Aug 12, 2024 · attack.defense-evasion attack.persistence attack.privilege-escalation attack.t1574.001 attack.t1574.002 ·
Share on:

Detects potential DLL sideloading of "libcurl.dll" by the "gup.exe" process from an uncommon location

Read More
Potential DLL Sideloading Of Non-Existent DLLs From System Folders

Aug 12, 2024 · attack.defense-evasion attack.persistence attack.privilege-escalation attack.t1574.001 attack.t1574.002 ·
Share on:

Detects DLL sideloading of system DLLs that are not present on the system by default (at least not in system directories). Usually this technique is used to achieve UAC bypass or privilege escalation.

Read More
Potential DLL Sideloading Via ClassicExplorer32.dll

Aug 12, 2024 · attack.defense-evasion attack.persistence attack.privilege-escalation attack.t1574.001 attack.t1574.002 ·
Share on:

Detects potential DLL sideloading using ClassicExplorer32.dll from the Classic Shell software

Read More
Potential DLL Sideloading Via comctl32.dll

Aug 12, 2024 · attack.defense-evasion attack.persistence attack.privilege-escalation attack.t1574.001 attack.t1574.002 ·
Share on:

Detects potential DLL sideloading using comctl32.dll to obtain system privileges

Read More
Potential DLL Sideloading Via JsSchHlp

Aug 12, 2024 · attack.defense-evasion attack.persistence attack.privilege-escalation attack.t1574.001 attack.t1574.002 ·
Share on:

Detects potential DLL sideloading using JUSTSYSTEMS Japanese word processor

Read More
Potential Dridex Activity

Aug 12, 2024 · attack.defense-evasion attack.privilege-escalation attack.t1055 attack.discovery attack.t1135 attack.t1033 detection.emerging-threats ·
Share on:

Detects potential Dridex acitvity via specific process patterns

Read More
Potential EACore.DLL Sideloading

Aug 12, 2024 · attack.defense-evasion attack.privilege-escalation attack.t1574.001 attack.t1574.002 ·
Share on:

Detects potential DLL sideloading of "EACore.dll"

Read More
Potential Edputil.DLL Sideloading

Aug 12, 2024 · attack.defense-evasion attack.privilege-escalation attack.t1574.001 attack.t1574.002 ·
Share on:

Detects potential DLL sideloading of "edputil.dll"

Read More
Potential Goopdate.DLL Sideloading

Aug 12, 2024 · attack.defense-evasion attack.privilege-escalation attack.t1574.001 attack.t1574.002 ·
Share on:

Detects potential DLL sideloading of "goopdate.dll", a DLL used by googleupdate.exe

Read More
Potential Iviewers.DLL Sideloading

Aug 12, 2024 · attack.defense-evasion attack.privilege-escalation attack.t1574.001 attack.t1574.002 ·
Share on:

Detects potential DLL sideloading of "iviewers.dll" (OLE/COM Object Interface Viewer)

Read More
Potential Libvlc.DLL Sideloading

Aug 12, 2024 · attack.defense-evasion attack.persistence attack.privilege-escalation attack.t1574.001 attack.t1574.002 ·
Share on:

Detects potential DLL sideloading of "libvlc.dll", a DLL that is legitimately used by "VLC.exe"

Read More
Potential Malicious Usage of CloudTrail System Manager

Aug 12, 2024 · attack.privilege-escalation attack.t1566 attack.t1566.002 ·
Share on:

Detect when System Manager successfully executes commands against an instance.

Read More
Potential Meterpreter/CobaltStrike Activity

Aug 12, 2024 · attack.privilege-escalation attack.t1134.001 attack.t1134.002 ·
Share on:

Detects the use of getsystem Meterpreter/Cobalt Strike command by detecting a specific service starting

Read More
Potential Mfdetours.DLL Sideloading

Aug 12, 2024 · attack.defense-evasion attack.privilege-escalation attack.t1574.001 attack.t1574.002 ·
Share on:

Detects potential DLL sideloading of "mfdetours.dll". While using "mftrace.exe" it can be abused to attach to an arbitrary process and force load any DLL named "mfdetours.dll" from the current directory of execution.

Read More
Potential Persistence Via GlobalFlags

Aug 12, 2024 · attack.privilege-escalation attack.persistence attack.defense-evasion attack.t1546.012 car.2013-01-002 ·
Share on:

Detects registry persistence technique using the GlobalFlags and SilentProcessExit keys

Read More
Potential Persistence Via Netsh Helper DLL

Aug 12, 2024 · attack.privilege-escalation attack.persistence attack.t1546.007 attack.s0108 ·
Share on:

Detects the execution of netsh with "add helper" flag in order to add a custom helper DLL. This technique can be abused to add a malicious helper DLL that can be used as a persistence proxy that gets called when netsh.exe is executed.

Read More
Potential Persistence Via PowerShell User Profile Using Add-Content

Aug 12, 2024 · attack.persistence attack.privilege-escalation attack.t1546.013 ·
Share on:

Detects calls to "Add-Content" cmdlet in order to modify the content of the user profile and potentially adding suspicious commands for persistence

Read More
Potential Persistence Via Security Descriptors - ScriptBlock

Aug 12, 2024 · attack.persistence attack.defense-evasion attack.privilege-escalation ·
Share on:

Detects usage of certain functions and keywords that are used to manipulate security descriptors in order to potentially set a backdoor. As seen used in the DAMP project.

Read More
Potential Privilege Escalation Attempt Via .Exe.Local Technique

Aug 12, 2024 · attack.defense-evasion attack.persistence attack.privilege-escalation ·
Share on:

Detects potential privilege escalation attempt via the creation of the "*.Exe.Local" folder inside the "System32" directory in order to sideload "comctl32.dll"

Read More
Potential Privilege Escalation Using Symlink Between Osk and Cmd

Aug 12, 2024 · attack.privilege-escalation attack.persistence attack.t1546.008 ·
Share on:

Detects the creation of a symbolic link between "cmd.exe" and the accessibility on-screen keyboard binary (osk.exe) using "mklink". This technique provides an elevated command prompt to the user from the login screen without the need to log in.

Read More
Potential Raspberry Robin Aclui Dll SideLoading

Aug 12, 2024 · detection.emerging-threats attack.defense-evasion attack.privilege-escalation attack.t1574.001 attack.t1574.002 ·
Share on:

Detects potential sideloading of malicious "aclui.dll" by OleView.This behavior was observed in Raspberry-Robin variants reported by chekpoint research on Feburary 2024.

Read More
Potential Rcdll.DLL Sideloading

Aug 12, 2024 · attack.defense-evasion attack.privilege-escalation attack.t1574.001 attack.t1574.002 ·
Share on:

Detects potential DLL sideloading of rcdll.dll

Read More
Potential RjvPlatform.DLL Sideloading From Default Location

Aug 12, 2024 · attack.defense-evasion attack.privilege-escalation attack.t1574.001 attack.t1574.002 ·
Share on:

Detects loading of "RjvPlatform.dll" by the "SystemResetPlatform.exe" binary which can be abused as a method of DLL side loading since the "$SysReset" directory isn't created by default.

Read More
Potential RjvPlatform.DLL Sideloading From Non-Default Location

Aug 12, 2024 · attack.defense-evasion attack.privilege-escalation attack.t1574.001 attack.t1574.002 ·
Share on:

Detects potential DLL sideloading of "RjvPlatform.dll" by "SystemResetPlatform.exe" located in a non-default location.

Read More
Potential RoboForm.DLL Sideloading

Aug 12, 2024 · attack.defense-evasion attack.privilege-escalation attack.t1574.001 attack.t1574.002 ·
Share on:

Detects potential DLL sideloading of "roboform.dll", a DLL used by RoboForm Password Manager

Read More
Potential ShellDispatch.DLL Sideloading

Aug 12, 2024 · attack.defense-evasion attack.privilege-escalation attack.t1574.001 attack.t1574.002 ·
Share on:

Detects potential DLL sideloading of "ShellDispatch.dll"

Read More
Potential Shim Database Persistence via Sdbinst.EXE

Aug 12, 2024 · attack.persistence attack.privilege-escalation attack.t1546.011 ·
Share on:

Detects installation of a new shim using sdbinst.exe. Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by application shims

Read More
Potential SmadHook.DLL Sideloading

Aug 12, 2024 · attack.defense-evasion attack.privilege-escalation attack.t1574.001 attack.t1574.002 ·
Share on:

Detects potential DLL sideloading of "SmadHook.dll", a DLL used by SmadAV antivirus

Read More
Potential SolidPDFCreator.DLL Sideloading

Aug 12, 2024 · attack.defense-evasion attack.privilege-escalation attack.t1574.001 attack.t1574.002 ·
Share on:

Detects potential DLL sideloading of "SolidPDFCreator.dll"

Read More
Potential Suspicious Activity Using SeCEdit

Aug 12, 2024 · attack.discovery attack.persistence attack.defense-evasion attack.credential-access attack.privilege-escalation attack.t1562.002 attack.t1547.001 attack.t1505.005 attack.t1556.002 attack.t1562 attack.t1574.007 attack.t1564.002 attack.t1546.008 attack.t1546.007 attack.t1547.014 attack.t1547.010 attack.t1547.002 attack.t1557 attack.t1082 ·
Share on:

Detects potential suspicious behaviour using secedit.exe. Such as exporting or modifying the security policy

Read More
Potential System DLL Sideloading From Non System Locations

Aug 12, 2024 · attack.defense-evasion attack.persistence attack.privilege-escalation attack.t1574.001 attack.t1574.002 ·
Share on:

Detects DLL sideloading of DLLs usually located in system locations (System32, SysWOW64, etc.).

Read More
Potential SystemNightmare Exploitation Attempt

Aug 12, 2024 · attack.privilege-escalation attack.t1068 detection.emerging-threats ·
Share on:

Detects an exploitation attempt of SystemNightmare in order to obtain a shell as LOCAL_SYSTEM

Read More
Potential Vivaldi_elf.DLL Sideloading

Aug 12, 2024 · attack.defense-evasion attack.privilege-escalation attack.t1574.001 attack.t1574.002 ·
Share on:

Detects potential DLL sideloading of "vivaldi_elf.dll"

Read More
Potential Waveedit.DLL Sideloading

Aug 12, 2024 · attack.defense-evasion attack.privilege-escalation attack.t1574.001 attack.t1574.002 ·
Share on:

Detects potential DLL sideloading of "waveedit.dll", which is part of the Nero WaveEditor audio editing software.

Read More
Potential Wazuh Security Platform DLL Sideloading

Aug 12, 2024 · attack.defense-evasion attack.persistence attack.privilege-escalation attack.t1574.001 attack.t1574.002 ·
Share on:

Detects potential DLL side loading of DLLs that are part of the Wazuh security platform

Read More
Potential WWlib.DLL Sideloading

Aug 12, 2024 · attack.defense-evasion attack.privilege-escalation attack.t1574.001 attack.t1574.002 ·
Share on:

Detects potential DLL sideloading of "wwlib.dll"

Read More
Potentially Suspicious Child Process of KeyScrambler.exe

Aug 12, 2024 · attack.execution attack.defense-evasion attack.privilege-escalation attack.t1203 attack.t1574.002 ·
Share on:

Detects potentially suspicious child processes of KeyScrambler.exe

Read More
Potentially Suspicious Event Viewer Child Process

Aug 12, 2024 · attack.defense-evasion attack.privilege-escalation attack.t1548.002 car.2019-04-001 ·
Share on:

Detects uncommon or suspicious child processes of "eventvwr.exe" which might indicate a UAC bypass attempt

Read More
PowerShell Profile Modification

Aug 12, 2024 · attack.persistence attack.privilege-escalation attack.t1546.013 ·
Share on:

Detects the creation or modification of a powershell profile which could indicate suspicious activity as the profile can be used as a mean of persistence

Read More
PowerShell ShellCode

Aug 12, 2024 · attack.defense-evasion attack.privilege-escalation attack.t1055 attack.execution attack.t1059.001 ·
Share on:

Detects Base64 encoded Shellcode

Read More
Powershell WMI Persistence

Aug 12, 2024 · attack.privilege-escalation attack.t1546.003 ·
Share on:

Adversaries may establish persistence and elevate privileges by executing malicious content triggered by a Windows Management Instrumentation (WMI) event subscription.

Read More
Privileged Account Creation

Aug 12, 2024 · attack.persistence attack.privilege-escalation attack.t1078.004 ·
Share on:

Detects when a new admin is created.

Read More
Process Creation Using Sysnative Folder

Aug 12, 2024 · attack.defense-evasion attack.privilege-escalation attack.t1055 ·
Share on:

Detects process creation events that use the Sysnative folder (common for CobaltStrike spawns)

Read More
Process Explorer Driver Creation By Non-Sysinternals Binary

Aug 12, 2024 · attack.persistence attack.privilege-escalation attack.t1068 ·
Share on:

Detects creation of the Process Explorer drivers by processes other than Process Explorer (procexp) itself. Hack tools or malware may use the Process Explorer driver to elevate privileges, drops it to disk for a few moments, runs a service using that driver and removes it afterwards.

Read More
Process Monitor Driver Creation By Non-Sysinternals Binary

Aug 12, 2024 · attack.persistence attack.privilege-escalation attack.t1068 ·
Share on:

Detects creation of the Process Monitor driver by processes other than Process Monitor (procmon) itself.

Read More
ProcessHacker Privilege Elevation

Aug 12, 2024 · attack.execution attack.privilege-escalation attack.t1543.003 attack.t1569.002 ·
Share on:

Detects a ProcessHacker tool that elevated privileges to a very high level

Read More
PSEXEC Remote Execution File Artefact

Aug 12, 2024 · attack.lateral-movement attack.privilege-escalation attack.execution attack.persistence attack.t1136.002 attack.t1543.003 attack.t1570 attack.s0029 ·
Share on:

Detects creation of the PSEXEC key file. Which is created anytime a PsExec command is executed. It gets written to the file system and will be recorded in the USN Journal on the target system

Read More
PUA - AdvancedRun Execution

Aug 12, 2024 · attack.execution attack.defense-evasion attack.privilege-escalation attack.t1564.003 attack.t1134.002 attack.t1059.003 ·
Share on:

Detects the execution of AdvancedRun utility

Read More
PUA - AdvancedRun Suspicious Execution

Aug 12, 2024 · attack.defense-evasion attack.privilege-escalation attack.t1134.002 ·
Share on:

Detects the execution of AdvancedRun utility in the context of the TrustedInstaller, SYSTEM, Local Service or Network Service accounts

Read More
PUA - Wsudo Suspicious Execution

Aug 12, 2024 · attack.execution attack.privilege-escalation attack.t1059 ·
Share on:

Detects usage of wsudo (Windows Sudo Utility). Which is a tool that let the user execute programs with different permissions (System, Trusted Installer, Administrator...etc)

Read More
Rare Remote Thread Creation By Uncommon Source Image

Aug 12, 2024 · attack.privilege-escalation attack.defense-evasion attack.t1055 ·
Share on:

Detects uncommon processes creating remote threads.

Read More
Regedit as Trusted Installer

Aug 12, 2024 · attack.privilege-escalation attack.t1548 ·
Share on:

Detects a regedit started with TrustedInstaller privileges or by ProcessHacker.exe

Read More
Remote Thread Creation By Uncommon Source Image

Aug 12, 2024 · attack.privilege-escalation attack.defense-evasion attack.t1055 ·
Share on:

Detects uncommon processes creating remote threads.

Read More
Remote Thread Creation In Uncommon Target Image

Aug 12, 2024 · attack.defense-evasion attack.privilege-escalation attack.t1055.003 ·
Share on:

Detects uncommon target processes for remote thread creation

Read More
Renamed Mavinject.EXE Execution

Aug 12, 2024 · attack.defense-evasion attack.privilege-escalation attack.t1055.001 attack.t1218.013 ·
Share on:

Detects the execution of a renamed version of the "Mavinject" process. Which can be abused to perform process injection using the "/INJECTRUNNING" flag

Read More
Roles Activated Too Frequently

Aug 12, 2024 · attack.t1078 attack.persistence attack.privilege-escalation ·
Share on:

Identifies when the same privilege role has multiple activations by the same user.

Read More
Roles Activation Doesn't Require MFA

Aug 12, 2024 · attack.t1078 attack.persistence attack.privilege-escalation ·
Share on:

Identifies when a privilege role can be activated without performing mfa.

Read More
Roles Are Not Being Used

Aug 12, 2024 · attack.t1078 attack.persistence attack.privilege-escalation ·
Share on:

Identifies when a user has been assigned a privilege role and are not using that role.

Read More
Roles Assigned Outside PIM

Aug 12, 2024 · attack.t1078 attack.persistence attack.privilege-escalation ·
Share on:

Identifies when a privilege role assignment has taken place outside of PIM and may indicate an attack.

Read More
RottenPotato Like Attack Pattern

Aug 12, 2024 · attack.privilege-escalation attack.credential-access attack.t1557.001 ·
Share on:

Detects logon events that have characteristics of events generated during an attack with RottenPotato and the like

Read More
Rundll32 Registered COM Objects

Aug 12, 2024 · attack.privilege-escalation attack.persistence attack.t1546.015 ·
Share on:

load malicious registered COM objects

Read More
Scheduled Cron Task/Job - Linux

Aug 12, 2024 · attack.execution attack.persistence attack.privilege-escalation attack.t1053.003 ·
Share on:

Detects abuse of the cron utility to perform task scheduling for initial or recurring execution of malicious code. Detection will focus on crontab jobs uploaded from the tmp folder.

Read More
Scheduled Cron Task/Job - MacOs

Aug 12, 2024 · attack.execution attack.persistence attack.privilege-escalation attack.t1053.003 ·
Share on:

Detects abuse of the cron utility to perform task scheduling for initial or recurring execution of malicious code. Detection will focus on crontab jobs uploaded from the tmp folder.

Read More
Scheduled Task Creation Via Schtasks.EXE

Aug 12, 2024 · attack.execution attack.persistence attack.privilege-escalation attack.t1053.005 attack.s0111 car.2013-08-001 stp.1u ·
Share on:

Detects the creation of scheduled tasks by user accounts via the "schtasks" utility.

Read More
SCM Database Privileged Operation

Aug 12, 2024 · attack.privilege-escalation attack.t1548 ·
Share on:

Detects non-system users performing privileged operation os the SCM database

Read More
Sdclt Child Processes

Aug 12, 2024 · attack.privilege-escalation attack.t1548.002 ·
Share on:

A General detection for sdclt spawning new processes. This could be an indicator of sdclt being used for bypass UAC techniques.

Read More
Security Privileges Enumeration Via Whoami.EXE

Aug 12, 2024 · attack.privilege-escalation attack.discovery attack.t1033 ·
Share on:

Detects a whoami.exe executed with the /priv command line flag instructing the tool to show all current user privileges. This is often used after a privilege escalation attempt.

Read More
Service DACL Abuse To Hide Services Via Sc.EXE

Aug 12, 2024 · attack.persistence attack.defense-evasion attack.privilege-escalation attack.t1574.011 ·
Share on:

Detects usage of the "sc.exe" utility adding a new service with special permission seen used by threat actors which makes the service hidden and unremovable.

Read More
Service Installation in Suspicious Folder

Aug 12, 2024 · attack.persistence attack.privilege-escalation car.2013-09-005 attack.t1543.003 ·
Share on:

Detects service installation in suspicious folder appdata

Read More
Service Installation with Suspicious Folder Pattern

Aug 12, 2024 · attack.persistence attack.privilege-escalation car.2013-09-005 attack.t1543.003 ·
Share on:

Detects service installation with suspicious folder patterns

Read More
Service Installed By Unusual Client - Security

Aug 12, 2024 · attack.privilege-escalation attack.t1543 ·
Share on:

Detects a service installed by a client which has PID 0 or whose parent has PID 0

Read More
Service Installed By Unusual Client - System

Aug 12, 2024 · attack.privilege-escalation attack.t1543 ·
Share on:

Detects a service installed by a client which has PID 0 or whose parent has PID 0

Read More
Service Registry Key Read Access Request

Aug 12, 2024 · attack.defense-evasion attack.persistence attack.privilege-escalation attack.t1574.011 ·
Share on:

Detects "read access" requests on the services registry key. Adversaries may execute their own malicious payloads by hijacking the Registry entries used by services. Adversaries may use flaws in the permissions for Registry keys related to services to redirect from the originally specified executable to one that they control, in order to launch their own code when a service starts.

Read More
Service Security Descriptor Tampering Via Sc.EXE

Aug 12, 2024 · attack.persistence attack.defense-evasion attack.privilege-escalation attack.t1574.011 ·
Share on:

Detection of sc.exe utility adding a new service with special permission which hides that service.

Read More
ServiceDll Hijack

Aug 12, 2024 · attack.persistence attack.privilege-escalation attack.t1543.003 ·
Share on:

Detects changes to the "ServiceDLL" value related to a service in the registry. This is often used as a method of persistence.

Read More
Shell Open Registry Keys Manipulation

Aug 12, 2024 · attack.defense-evasion attack.privilege-escalation attack.t1548.002 attack.t1546.001 ·
Share on:

Detects the shell open key manipulation (exefile and ms-settings) used for persistence and the pattern of UAC Bypass using fodhelper.exe, computerdefaults.exe, slui.exe via registry keys (e.g. UACMe 33 or 62)

Read More
Shell Process Spawned by Java.EXE

Aug 12, 2024 · attack.initial-access attack.persistence attack.privilege-escalation ·
Share on:

Detects shell spawned from Java host process, which could be a sign of exploitation (e.g. log4j exploitation)

Read More
Sliver C2 Default Service Installation

Aug 12, 2024 · attack.execution attack.privilege-escalation attack.t1543.003 attack.t1569.002 ·
Share on:

Detects known malicious service installation that appear in cases in which a Sliver implants execute the PsExec commands

Read More
SOURGUM Actor Behaviours

Aug 12, 2024 · attack.t1546 attack.t1546.015 attack.persistence attack.privilege-escalation detection.emerging-threats ·
Share on:

Suspicious behaviours related to an actor tracked by Microsoft as SOURGUM

Read More
Stale Accounts In A Privileged Role

Aug 12, 2024 · attack.t1078 attack.persistence attack.privilege-escalation ·
Share on:

Identifies when an account hasn't signed in during the past n number of days.

Read More
Standard User In High Privileged Group

Aug 12, 2024 · attack.credential-access attack.privilege-escalation ·
Share on:

Detect standard users login that are part of high privileged groups such as the Administrator group

Read More
Startup Item File Created - MacOS

Aug 12, 2024 · attack.persistence attack.privilege-escalation attack.t1037.005 ·
Share on:

Detects the creation of a startup item plist file, that automatically get executed at boot initialization to establish persistence. Adversaries may use startup items automatically executed at boot initialization to establish persistence. Startup items execute during the final phase of the boot process and contain shell scripts or other executable files along with configuration information used by the system to determine the execution order for all startup items.

Read More
Sticky Key Like Backdoor Execution

Aug 12, 2024 · attack.privilege-escalation attack.persistence attack.t1546.008 car.2014-11-003 car.2014-11-008 ·
Share on:

Detects the usage and installation of a backdoor that uses an option to register a malicious debugger for built-in tools that are accessible in the login screen

Read More
Sticky Key Like Backdoor Usage - Registry

Aug 12, 2024 · attack.privilege-escalation attack.persistence attack.t1546.008 car.2014-11-003 car.2014-11-008 ·
Share on:

Detects the usage and installation of a backdoor that uses an option to register a malicious debugger for built-in tools that are accessible in the login screen

Read More
Sudo Privilege Escalation CVE-2019-14287

Aug 12, 2024 · attack.privilege-escalation attack.t1068 attack.t1548.003 cve.2019-14287 ·
Share on:

Detects users trying to exploit sudo vulnerability reported in CVE-2019-14287

Read More
Sudo Privilege Escalation CVE-2019-14287 - Builtin

Aug 12, 2024 · attack.privilege-escalation attack.t1068 attack.t1548.003 cve.2019-14287 ·
Share on:

Detects users trying to exploit sudo vulnerability reported in CVE-2019-14287

Read More
Suspect Svchost Activity

Aug 12, 2024 · attack.defense-evasion attack.privilege-escalation attack.t1055 ·
Share on:

It is extremely abnormal for svchost.exe to spawn without any CLI arguments and is normally observed when a malicious process spawns the process and injects code into the process memory space.

Read More
Suspicious Browser Activity

Aug 12, 2024 · attack.t1078 attack.persistence attack.defense-evasion attack.privilege-escalation attack.initial-access ·
Share on:

Indicates anomalous behavior based on suspicious sign-in activity across multiple tenants from different countries in the same browser

Read More
Suspicious Child Process Of SQL Server

Aug 12, 2024 · attack.t1505.003 attack.t1190 attack.initial-access attack.persistence attack.privilege-escalation ·
Share on:

Detects suspicious child processes of the SQLServer process. This could indicate potential RCE or SQL Injection.

Read More
Suspicious Child Process Of Veeam Dabatase

Aug 12, 2024 · attack.initial-access attack.persistence attack.privilege-escalation ·
Share on:

Detects suspicious child processes of the Veeam service process. This could indicate potential RCE or SQL Injection.

Read More
Suspicious Debugger Registration Cmdline

Aug 12, 2024 · attack.persistence attack.privilege-escalation attack.t1546.008 ·
Share on:

Detects the registration of a debugger for a program that is available in the logon screen (sticky key backdoor).

Read More
Suspicious GetTypeFromCLSID ShellExecute

Aug 12, 2024 · attack.privilege-escalation attack.persistence attack.t1546.015 ·
Share on:

Detects suspicious Powershell code that execute COM Objects

Read More
Suspicious New Service Creation

Aug 12, 2024 · attack.persistence attack.privilege-escalation attack.t1543.003 ·
Share on:

Detects creation of a new service via "sc" command or the powershell "new-service" cmdlet with suspicious binary paths

Read More
Suspicious NTLM Authentication on the Printer Spooler Service

Aug 12, 2024 · attack.privilege-escalation attack.credential-access attack.t1212 ·
Share on:

Detects a privilege elevation attempt by coercing NTLM authentication on the Printer Spooler service

Read More
Suspicious Printer Driver Empty Manufacturer

Aug 12, 2024 · attack.privilege-escalation attack.t1574 cve.2021-1675 ·
Share on:

Detects a suspicious printer driver installation with an empty Manufacturer value

Read More
Suspicious Processes Spawned by WinRM

Aug 12, 2024 · attack.t1190 attack.initial-access attack.persistence attack.privilege-escalation ·
Share on:

Detects suspicious processes including shells spawnd from WinRM host process

Read More
Suspicious RunAs-Like Flag Combination

Aug 12, 2024 · attack.privilege-escalation ·
Share on:

Detects suspicious command line flags that let the user set a target user and command as e.g. seen in PsExec-like tools

Read More
Suspicious Scheduled Task Creation

Aug 12, 2024 · attack.execution attack.privilege-escalation attack.persistence attack.t1053.005 ·
Share on:

Detects suspicious scheduled task creation events. Based on attributes such as paths, commands line flags, etc.

Read More
Suspicious Scheduled Task Update

Aug 12, 2024 · attack.execution attack.privilege-escalation attack.persistence attack.t1053.005 ·
Share on:

Detects update to a scheduled task event that contain suspicious keywords.

Read More
Suspicious ScreenSave Change by Reg.exe

Aug 12, 2024 · attack.privilege-escalation attack.t1546.002 ·
Share on:

Adversaries may establish persistence by executing malicious content triggered by user inactivity. Screensavers are programs that execute after a configurable time of user inactivity and consist of Portable Executable (PE) files with a .scr file extension

Read More
Suspicious Service DACL Modification Via Set-Service Cmdlet - PS

Aug 12, 2024 · attack.persistence attack.defense-evasion attack.privilege-escalation attack.t1574.011 ·
Share on:

Detects usage of the "Set-Service" powershell cmdlet to configure a new SecurityDescriptor that allows a service to be hidden from other utilities such as "sc.exe", "Get-Service"...etc. (Works only in powershell 7)

Read More
Suspicious Service Installation

Aug 12, 2024 · attack.persistence attack.privilege-escalation car.2013-09-005 attack.t1543.003 ·
Share on:

Detects suspicious service installation commands

Read More
Suspicious Service Installation Script

Aug 12, 2024 · attack.persistence attack.privilege-escalation car.2013-09-005 attack.t1543.003 ·
Share on:

Detects suspicious service installation scripts

Read More
Suspicious Service Path Modification

Aug 12, 2024 · attack.persistence attack.privilege-escalation attack.t1543.003 ·
Share on:

Detects service path modification via the "sc" binary to a suspicious command or path

Read More
Suspicious Shells Spawn by Java Utility Keytool

Aug 12, 2024 · attack.initial-access attack.persistence attack.privilege-escalation ·
Share on:

Detects suspicious shell spawn from Java utility keytool process (e.g. adselfservice plus exploitation)

Read More
Suspicious SQL Query

Aug 12, 2024 · attack.exfiltration attack.initial-access attack.privilege-escalation attack.t1190 attack.t1505.001 ·
Share on:

Detects suspicious SQL query keywrods that are often used during recon, exfiltration or destructive activities. Such as dropping tables and selecting wildcard fields

Read More
Third Party Software DLL Sideloading

Aug 12, 2024 · attack.defense-evasion attack.persistence attack.privilege-escalation attack.t1574.001 attack.t1574.002 ·
Share on:

Detects DLL sideloading of DLLs that are part of third party software (zoom, discord....etc)

Read More
Too Many Global Admins

Aug 12, 2024 · attack.t1078 attack.persistence attack.privilege-escalation ·
Share on:

Identifies an event where there are there are too many accounts assigned the Global Administrator role.

Read More
Triple Cross eBPF Rootkit Execve Hijack

Aug 12, 2024 · attack.defense-evasion attack.privilege-escalation ·
Share on:

Detects execution of a the file "execve_hijack" which is used by the Triple Cross rootkit as a way to elevate privileges

Read More
UAC Bypass Abusing Winsat Path Parsing - File

Aug 12, 2024 · attack.defense-evasion attack.privilege-escalation attack.t1548.002 ·
Share on:

Detects the pattern of UAC Bypass using a path parsing issue in winsat.exe (UACMe 52)

Read More
UAC Bypass Abusing Winsat Path Parsing - Registry

Aug 12, 2024 · attack.defense-evasion attack.privilege-escalation attack.t1548.002 ·
Share on:

Detects the pattern of UAC Bypass using a path parsing issue in winsat.exe (UACMe 52)

Read More
UAC Bypass Using .NET Code Profiler on MMC

Aug 12, 2024 · attack.defense-evasion attack.privilege-escalation attack.t1548.002 ·
Share on:

Detects the pattern of UAC Bypass using .NET Code Profiler and mmc.exe DLL hijacking (UACMe 39)

Read More
UAC Bypass Using Consent and Comctl32 - File

Aug 12, 2024 · attack.defense-evasion attack.privilege-escalation attack.t1548.002 ·
Share on:

Detects the pattern of UAC Bypass using consent.exe and comctl32.dll (UACMe 22)

Read More
UAC Bypass Using Event Viewer RecentViews

Aug 12, 2024 · attack.defense-evasion attack.privilege-escalation ·
Share on:

Detects the pattern of UAC Bypass using Event Viewer RecentViews

Read More
UAC Bypass Using EventVwr

Aug 12, 2024 · attack.defense-evasion attack.privilege-escalation ·
Share on:

Detects the pattern of a UAC bypass using Windows Event Viewer

Read More
UAC Bypass Using IDiagnostic Profile - File

Aug 12, 2024 · attack.execution attack.defense-evasion attack.privilege-escalation attack.t1548.002 ·
Share on:

Detects the creation of a file by "dllhost.exe" in System32 directory part of "IDiagnosticProfileUAC" UAC bypass technique

Read More
UAC Bypass Using IEInstal - File

Aug 12, 2024 · attack.defense-evasion attack.privilege-escalation attack.t1548.002 ·
Share on:

Detects the pattern of UAC Bypass using IEInstal.exe (UACMe 64)

Read More
UAC Bypass Using Iscsicpl - ImageLoad

Aug 12, 2024 · attack.defense-evasion attack.privilege-escalation attack.t1548.002 ·
Share on:

Detects the "iscsicpl.exe" UAC bypass technique that leverages a DLL Search Order hijacking technique to load a custom DLL's from temp or a any user controlled location in the users %PATH%

Read More
UAC Bypass Using MSConfig Token Modification - File

Aug 12, 2024 · attack.defense-evasion attack.privilege-escalation attack.t1548.002 ·
Share on:

Detects the pattern of UAC Bypass using a msconfig GUI hack (UACMe 55)

Read More
UAC Bypass Using NTFS Reparse Point - File

Aug 12, 2024 · attack.defense-evasion attack.privilege-escalation attack.t1548.002 ·
Share on:

Detects the pattern of UAC Bypass using NTFS reparse point and wusa.exe DLL hijacking (UACMe 36)

Read More
UAC Bypass Using Windows Media Player - File

Aug 12, 2024 · attack.defense-evasion attack.privilege-escalation attack.t1548.002 ·
Share on:

Detects the pattern of UAC Bypass using Windows Media Player osksupport.dll (UACMe 32)

Read More
UAC Bypass Using Windows Media Player - Registry

Aug 12, 2024 · attack.defense-evasion attack.privilege-escalation attack.t1548.002 ·
Share on:

Detects the pattern of UAC Bypass using Windows Media Player osksupport.dll (UACMe 32)

Read More
UAC Bypass Using WOW64 Logger DLL Hijack

Aug 12, 2024 · attack.defense-evasion attack.privilege-escalation attack.t1548.002 ·
Share on:

Detects the pattern of UAC Bypass using a WoW64 logger DLL hijack (UACMe 30)

Read More
UAC Bypass via Event Viewer

Aug 12, 2024 · attack.defense-evasion attack.privilege-escalation attack.t1548.002 car.2019-04-001 ·
Share on:

Detects UAC bypass method using Windows event viewer

Read More
UAC Bypass via ICMLuaUtil

Aug 12, 2024 · attack.defense-evasion attack.privilege-escalation attack.t1548.002 ·
Share on:

Detects the pattern of UAC Bypass using ICMLuaUtil Elevated COM interface

Read More
UAC Bypass via Sdclt

Aug 12, 2024 · attack.defense-evasion attack.privilege-escalation attack.t1548.002 car.2019-04-001 ·
Share on:

Detects the pattern of UAC Bypass using registry key manipulation of sdclt.exe (e.g. UACMe 53)

Read More
UAC Bypass via Windows Firewall Snap-In Hijack

Aug 12, 2024 · attack.privilege-escalation attack.t1548 ·
Share on:

Detects attempts to bypass User Account Control (UAC) by hijacking the Microsoft Management Console (MMC) Windows Firewall snap-in

Read More
UAC Bypass Via Wsreset

Aug 12, 2024 · attack.defense-evasion attack.privilege-escalation attack.t1548.002 ·
Share on:

Unfixed method for UAC bypass from Windows 10. WSReset.exe file associated with the Windows Store. It will run a binary file contained in a low-privilege registry.

Read More
UAC Bypass With Fake DLL

Aug 12, 2024 · attack.persistence attack.defense-evasion attack.privilege-escalation attack.t1548.002 attack.t1574.002 ·
Share on:

Attempts to load dismcore.dll after dropping it

Read More
UAC Disabled

Aug 12, 2024 · attack.privilege-escalation attack.defense-evasion attack.t1548.002 ·
Share on:

Detects when an attacker tries to disable User Account Control (UAC) by setting the registry value "EnableLUA" to 0.

Read More
UAC Notification Disabled

Aug 12, 2024 · attack.privilege-escalation attack.defense-evasion attack.t1548.002 ·
Share on:

Detects when an attacker tries to disable User Account Control (UAC) notification by tampering with the "UACDisableNotify" value. UAC is a critical security feature in Windows that prevents unauthorized changes to the operating system. It prompts the user for permission or an administrator password before allowing actions that could affect the system's operation or change settings that affect other users. When "UACDisableNotify" is set to 1, UAC prompts are suppressed.

Read More
UAC Secure Desktop Prompt Disabled

Aug 12, 2024 · attack.privilege-escalation attack.defense-evasion attack.t1548.002 ·
Share on:

Detects when an attacker tries to change User Account Control (UAC) elevation request destination via the "PromptOnSecureDesktop" value. The "PromptOnSecureDesktop" setting specifically determines whether UAC prompts are displayed on the secure desktop. The secure desktop is a separate desktop environment that's isolated from other processes running on the system. It's designed to prevent malicious software from intercepting or tampering with UAC prompts. When "PromptOnSecureDesktop" is set to 0, UAC prompts are displayed on the user's current desktop instead of the secure desktop. This reduces the level of security because it potentially exposes the prompts to manipulation by malicious software.

Read More
Uncommon Extension Shim Database Installation Via Sdbinst.EXE

Aug 12, 2024 · attack.persistence attack.privilege-escalation attack.t1546.011 ·
Share on:

Detects installation of a potentially suspicious new shim with an uncommon extension using sdbinst.exe. Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by application shims

Read More
Uncommon One Time Only Scheduled Task At 00:00

Aug 12, 2024 · attack.execution attack.persistence attack.privilege-escalation attack.t1053.005 ·
Share on:

Detects scheduled task creation events that include suspicious actions, and is run once at 00:00

Read More
Uncommon Process Access Rights For Target Image

Aug 12, 2024 · attack.defense-evasion attack.privilege-escalation attack.t1055.011 ·
Share on:

Detects process access request to uncommon target images with a "PROCESS_ALL_ACCESS" access mask.

Read More
Uncommon Service Installation Image Path

Aug 12, 2024 · attack.persistence attack.privilege-escalation car.2013-09-005 attack.t1543.003 ·
Share on:

Detects uncommon service installation commands by looking at suspicious or uncommon image path values containing references to encoded powershell commands, temporary paths, etc.

Read More
Unfamiliar Sign-In Properties

Aug 12, 2024 · attack.t1078 attack.persistence attack.defense-evasion attack.privilege-escalation attack.initial-access ·
Share on:

Detects sign-in with properties that are unfamiliar to the user. The detection considers past sign-in history to look for anomalous sign-ins.

Read More
Unsigned Mfdetours.DLL Sideloading

Aug 12, 2024 · attack.defense-evasion attack.privilege-escalation attack.t1574.001 attack.t1574.002 ·
Share on:

Detects DLL sideloading of unsigned "mfdetours.dll". Executing "mftrace.exe" can be abused to attach to an arbitrary process and force load any DLL named "mfdetours.dll" from the current directory of execution.

Read More
User Added To Admin Group Via Dscl

Aug 12, 2024 · attack.initial-access attack.privilege-escalation attack.t1078.003 ·
Share on:

Detects attempts to create and add an account to the admin group via "dscl"

Read More
User Added To Admin Group Via DseditGroup

Aug 12, 2024 · attack.initial-access attack.privilege-escalation attack.t1078.003 ·
Share on:

Detects attempts to create and/or add an account to the admin group, thus granting admin privileges.

Read More
User Added To Admin Group Via Sysadminctl

Aug 12, 2024 · attack.initial-access attack.privilege-escalation attack.t1078.003 ·
Share on:

Detects attempts to create and add an account to the admin group via "sysadminctl"

Read More
User Added to an Administrator's Azure AD Role

Aug 12, 2024 · attack.persistence attack.privilege-escalation attack.t1098.003 attack.t1078 ·
Share on:

User Added to an Administrator's Azure AD Role

Read More
User Added to Local Administrator Group

Aug 12, 2024 · attack.privilege-escalation attack.t1078 attack.persistence attack.t1098 ·
Share on:

Detects the addition of a new member to the local administrator group, which could be legitimate activity or a sign of privilege escalation activity

Read More
User Added To Privilege Role

Aug 12, 2024 · attack.privilege-escalation attack.defense-evasion attack.t1078.004 ·
Share on:

Detects when a user is added to a privileged role.

Read More
User Added To Root/Sudoers Group Using Usermod

Aug 12, 2024 · attack.privilege-escalation attack.persistence ·
Share on:

Detects usage of the "usermod" binary to add users add users to the root or suoders groups

Read More
User Couldn't Call a Privileged Service 'LsaRegisterLogonProcess'

Aug 12, 2024 · attack.lateral-movement attack.privilege-escalation attack.t1558.003 ·
Share on:

The 'LsaRegisterLogonProcess' function verifies that the application making the function call is a logon process by checking that it has the SeTcbPrivilege privilege set. Possible Rubeus tries to get a handle to LSA.

Read More
User State Changed From Guest To Member

Aug 12, 2024 · attack.privilege-escalation attack.initial-access attack.t1078.004 ·
Share on:

Detects the change of user type from "Guest" to "Member" for potential elevation of privilege.

Read More
Users Added to Global or Device Admin Roles

Aug 12, 2024 · attack.defense-evasion attack.privilege-escalation attack.t1078.004 ·
Share on:

Monitor and alert for users added to device admin roles.

Read More
VMGuestLib DLL Sideload

Aug 12, 2024 · attack.defense-evasion attack.persistence attack.privilege-escalation attack.t1574.001 attack.t1574.002 ·
Share on:

Detects DLL sideloading of VMGuestLib.dll by the WmiApSrv service.

Read More
VMMap Signed Dbghelp.DLL Potential Sideloading

Aug 12, 2024 · attack.defense-evasion attack.persistence attack.privilege-escalation attack.t1574.001 attack.t1574.002 ·
Share on:

Detects potential DLL sideloading of a signed dbghelp.dll by the Sysinternals VMMap.

Read More
VMMap Unsigned Dbghelp.DLL Potential Sideloading

Aug 12, 2024 · attack.defense-evasion attack.persistence attack.privilege-escalation attack.t1574.001 attack.t1574.002 ·
Share on:

Detects potential DLL sideloading of an unsigned dbghelp.dll by the Sysinternals VMMap.

Read More
VsCode Powershell Profile Modification

Aug 12, 2024 · attack.persistence attack.privilege-escalation attack.t1546.013 ·
Share on:

Detects the creation or modification of a vscode related powershell profile which could indicate suspicious activity as the profile can be used as a mean of persistence

Read More
Vulnerable Netlogon Secure Channel Connection Allowed

Aug 12, 2024 · attack.privilege-escalation attack.t1548 ·
Share on:

Detects that a vulnerable Netlogon secure channel connection was allowed, which could be an indicator of CVE-2020-1472.

Read More
Win Susp Computer Name Containing Samtheadmin

Aug 12, 2024 · cve.2021-42278 cve.2021-42287 attack.persistence attack.privilege-escalation attack.t1078 ·
Share on:

Detects suspicious computer name samtheadmin-{1..100}$ generated by hacktool

Read More
Windows Kernel Debugger Execution

Aug 12, 2024 · attack.defense-evasion attack.privilege-escalation ·
Share on:

Detects execution of the Windows Kernel Debugger "kd.exe".

Read More
WMI ActiveScriptEventConsumers Activity Via Scrcons.EXE DLL Load

Aug 12, 2024 · attack.lateral-movement attack.privilege-escalation attack.persistence attack.t1546.003 ·
Share on:

Detects signs of the WMI script host process "scrcons.exe" loading scripting DLLs which could indicates WMI ActiveScriptEventConsumers EventConsumers activity.

Read More
WMI Persistence

Aug 12, 2024 · attack.persistence attack.privilege-escalation attack.t1546.003 ·
Share on:

Detects suspicious WMI event filter and command line event consumer based on WMI and Security Logs.

Read More
WMI Persistence - Script Event Consumer

Aug 12, 2024 · attack.persistence attack.privilege-escalation attack.t1546.003 ·
Share on:

Detects WMI script event consumers

Read More
WMI Persistence - Security

Aug 12, 2024 · attack.persistence attack.privilege-escalation attack.t1546.003 ·
Share on:

Detects suspicious WMI event filter and command line event consumer based on WMI and Security Logs.

Read More